Skip to main content

Defend user guide

Updated

Overview

Defend is the endpoint detection and response (EDR) product. A lightweight agent runs on every protected device and streams process, network, and file telemetry. Defend alerts you, groups related alerts into an attack chain, and gives you response actions, such as isolating a device or collecting forensics, right from the alert.

What's not available yet: automated threat hunting, and evaluation of the custom rules in your rule library. Rules you add or enable are saved, but Defend doesn't run them yet. No detections doesn't mean a device is clean.

Use Defend when you need to respond to an endpoint detection in seconds instead of minutes.

Key Features

  • Real-time EDR agent — watches processes, network connections, file activity, and user logons.
  • Detection rules — curated rule library plus your own custom rules with MITRE ATT&CK mapping.
  • Behavioral analytics (UEBA) — baselines each user and device and surfaces anomalies.
  • Attack chain correlation — links related alerts into a single attack story.
  • Device isolation — take a compromised device off the network with one click. The agent still receives commands from Defend.
  • Remote response actions — kill a process, collect a forensics snapshot, run a response playbook.
  • Deception / honeytokens — planted fake credentials and files that trigger a critical alert when touched.
  • Threat hunting — queries over the event history. Not available yet: hunts don't run or return results today.
  • Attack simulations — record a planned technique against chosen devices. Not live: the console stores the simulation record, nothing runs the technique, and no fired rule is reported.
  • MITRE coverage map — see which tactics and techniques your rules are set up to cover. It counts enabled rules, not rules Defend is running today.
  • SOAR playbooks — bundle investigation and response steps into one action. Automated (hands-off) execution is off by default.
  • Network and web activity — NDR-style traffic analysis, shadow IT discovery.
  • Ransomware recovery reports — captured detonation telemetry that maps what the attack touched.
  • Threat intel feeds — STIX/TAXII ingestion with local enrichment.
  • Client risk scores — per-client composite risk rating.
  • Peer benchmarks — how your fleet compares against other MSPs.

How To: Enroll a Device in Defend

  1. Go to Endpoints → Install (or Defend → Agents → Install Agent).
  2. Click Generate Installer Token, pick the customer, and optionally set Max uses and Expires (default: 25 installs or 30 days).
  3. Click Generate Token and copy the token from the Installer ready dialog; it's shown only once.
  4. Copy the install command for the device's operating system and run it as an administrator.
  5. The device shows up in Defend → Agents as Protected within about a minute.

One token works for many devices. Revoke it under Active Tokens on Endpoints → Install when you're done. See Deploy the Defend agent.

How To: Triage a Defend Alert

  1. Open Alerts. Critical items are at the top.
  2. Click the alert to open its detail.
  3. Review:
    • The rule that fired and its MITRE technique.
    • The process tree, command line, and parent process.
    • Any related alerts already grouped into an attack chain.
  4. If this looks like a real attack, click Convert to Incident.
  5. If it is a false positive, click Mark False Positive and add a note; the tuning engine uses your feedback.
  6. Choose the response: Isolate Device, Kill Process, Collect Forensics, or Run Playbook.

How To: Isolate a Device

  1. Open the device, or open an alert on the device.
  2. Click Isolate.
  3. The agent is told to block all network traffic except its channel back to Defend. The isolation is effective within seconds on an online device.
  4. To lift it, click Release from Isolation on the device. Add a note explaining why.

How To: Kill a Running Process

Not available from the console today. The steps below described a Kill Process button and a process-entry field that the Defend console does not contain. Corrected 2026-08-04.

What is true: the platform has a kill-process command, and it requires a numeric process ID (PID). A process name alone is refused — the API rejects a request with no process_id. The incident decision panel does offer a "Stop the process" choice, but it submits no PID and therefore fails, reporting sent to 0/1 devices.

If you need a process stopped on an endpoint right now, use an RMM remote session or a script rather than this action, and tell your platform contact you needed it — that is what moves it up the queue.

How To: Collect Forensics

  1. Open the device or alert.
  2. Click Collect Forensics.
  3. The agent gathers a package — running processes, network connections, recent logs, and optionally a memory snapshot — and uploads it.
  4. When complete, a bundle link appears. Download it for offline analysis.

How To: Run a Threat Hunt

Not available yet. You can open Threat Hunt and read saved queries and templates, but running a hunt doesn't return results today, and scheduled hunts don't run. An error or empty result here doesn't mean there are no matching events. Use alerts, cases, and device pages to investigate instead.

How To: Deploy a SOAR Playbook

  1. Go to Playbooks.
  2. Pick an existing playbook or click New Playbook.
  3. A playbook is a list of steps — query, decide, act (isolate, kill, notify, etc.).
  4. Save. You can run it manually from an alert, or wire it to a rule — the latter only takes effect where automated response has been enabled (off by default).

How To: Plant a Honeytoken

  1. Go to Deception → Honeytokens.
  2. Click Create Honeytoken. Pick a type — file, credential, URL, or API key.
  3. Pick where to plant it (a device, a user's mail, a network share).
  4. The honeytoken is generated and deployed. When touched, it emits a critical alert with the full context of who touched it and from where.

How To: Check MITRE Coverage

Coverage shows rules you've enabled, not rules that are running. Defend doesn't evaluate rules from your rule library yet, so the map tells you which techniques you have rules for, not which techniques are being checked today.

  1. Go to MITRE Coverage.
  2. The matrix shades each technique by how many of your flagged rules map to it.
  3. Click a blank or light cell to see recommended rules you can enable.

How To: Run an Attack Simulation

Not live. The console records the simulation; nothing runs the technique and no fired rule is reported, so a simulation is a plan you store rather than a test that returns results.

  1. Go to Simulations.
  2. Pick a technique from the library.
  3. Choose the devices to run it on.
  4. Launch. The console stores the simulation record. It doesn't run the technique or report fired rules.
  5. There are no results to read yet. Treat a stored simulation as recorded intent, never as evidence that a rule fired.

Frequently Asked Questions

How is Defend different from Security? Defend is the endpoint-focused EDR product with its own agent and event warehouse. Security is the broader SOC dashboard that pulls alerts from many sources including Defend.

What happens when I isolate a device? All network traffic is blocked except the agent's channel back to Defend so you can keep taking action. The user cannot browse, email, or reach file shares until you release the device.

How long is event data kept? Raw endpoint events are kept for 90 days for investigation. Threat hunting over that history isn't available yet.

Can the agent be uninstalled from the endpoint? Yes, with an uninstall token generated from the Defend console. Uninstall tokens are short-lived (about 4 hours), so generate one right before you remove the agent. Tamper protection detects other attempts to stop or remove the agent and raises a critical alert; it doesn't block every attempt.

Do alerts automatically become incidents? Not by default. Correlation groups related alerts into attack chains; you decide when to promote a chain or alert into an incident.

Does Defend stop malware on its own? Not as it ships. Defend detects and alerts, and a person decides what to do: response actions (kill process, isolate the device, quarantine a file) are available from an alert or a device page and run when someone triggers them.

Automated SOAR response is built — a playbook can be wired to a detection rule so containment runs without a person — but it is off by default and has to be enabled deliberately, so unless you have arranged it with us nothing runs automatically. Separately, Defend does not block a program from executing in the first place.

Can I tune noisy rules? Yes. Use Alert Tuning or edit the rule directly. Marking alerts as False Positive trains the suppression engine.

Troubleshooting

Agent shows Offline even though the device is running. Check network connectivity to the agent endpoint. Verify the agent service is running. If it keeps falling offline, look at agent-health telemetry for crashes.

Isolate command did not take effect. The device must be online. If it is and isolation still failed, check the command status on the device page for an error; in rare cases the endpoint firewall has already been disabled by the attacker.

Response action says "replay rejected." Command signing prevents replays. This happens if the same command blob has already been completed. Click the action again to issue a fresh command.

Too many alerts from the same process. Create an exclusion scoped to that process path. Be specific — do not exclude broad directories.

Threat hunt returns an error or no results. Threat hunting isn't available yet, so this isn't a timeout or a slow query, and it doesn't mean there are no matching events. Narrowing the time range won't help. Use alerts, cases, and device pages instead.

MITRE coverage shows low despite many enabled rules. Coverage counts only rules that map to a specific technique. Open the rules and verify the MITRE mapping is set. The figure counts rules you've enabled, not rules Defend is running today.

Forensics bundle never finishes. The agent uploads in chunks. Very large bundles can take many minutes on slow links. If it still fails, trigger the collection again without the memory-snapshot option.