Defend is the endpoint detection and response (EDR) product in The One Stack. A lightweight agent on each enrolled device watches activity, Defend is designed to raise an alert when something looks malicious, and you contain it from one console — for every client you manage.
Detection availability: Detection evaluation is currently limited and may not be live in your environment, so alerts may not appear for activity on enrolled devices. This article describes how the workflow runs when detections are evaluating; it does not promise a working first detection today. No alerts does not mean a device is clean.
Who Defend is for
MSP security technicians and analysts who need to spot attacks across many client environments and respond in seconds, with per-client visibility and risk scores.
What Defend watches
The agent streams four kinds of activity from each device:
- Processes — every program launch, its command line, and what started it.
- Network connections — inbound and outbound connections and DNS lookups.
- File activity — reads, writes, deletes, and renames on sensitive paths.
- Sign-ins — interactive and remote sessions and privilege changes.
Events are kept for 90 days so you can look back when you investigate.
What you can do with Defend
| Capability | What it does for you |
|---|---|
| Detections | Raises an alert when activity matches known attacker behavior, mapped to MITRE ATT&CK techniques. |
| Behavior baselines | Learns what is normal for each user and device and flags unusual activity. |
| Attack chains | Groups related alerts into one story, so you triage one incident instead of 30 separate alerts. |
| Device isolation | Cuts a device off the network while Defend can still reach it. |
| Remote response | Kill a process, quarantine a file, or collect a forensics snapshot from the console. |
| Playbooks | Run a saved response workflow from an alert. Automatic playbooks are off by default. |
| Honeytokens | Plant decoy credentials and files that raise a critical alert when anyone touches them. |
| MITRE coverage map | Shows which attack techniques your detection rules are set up to cover. |
Not available yet: automated threat hunting (scheduled or custom queries over the event history) and attack simulations. You may see these pages in the console, but they don't return results today.
No detections doesn't mean a device is clean. Until automated hunting is available, use alerts, device activity, and your own investigation to judge a device's state.
Get started
- Install the agent on your client devices from Endpoints → Install. See Deploy the Defend agent.
- Review the default policy for each client. See Defend policies.
- Open Defend → Command Center to triage alerts, critical ones first.
- Learn where each workflow lives. See Defend's five areas: Sense, Investigate, Respond, Harden, Prove.
Tamper protection
Tamper protection detects attempts to stop or remove the agent and raises a critical alert. To remove the agent on purpose, use a short-lived uninstall token (valid about 4 hours) from the Defend console. See Deploy the Defend agent.
How Defend works with RMM and Security
- RMM: If you also use RMM, device details (hostname, OS, last seen) show up in Defend automatically, and response actions can travel through the RMM agent. RMM is not required.
- Security: Security is the wider SOC dashboard that collects alerts from many sources. When detections are evaluating, Defend alerts flow into it automatically. Use Defend when you need to go deep on one endpoint.
Common questions
Do I need RMM to use Defend?
No. Defend enrolls devices on its own; detection doesn't depend on RMM. RMM only adds extra device context and a second path for response actions.
Does Defend block malware before it runs?
No. Defend is detection and response: it alerts when something malicious happens, then you (or a playbook) contain it — isolate the device, kill the process, or quarantine the file. It does not stop a specific program from launching.
Is each client kept separate?
Yes. Each client organization has its own devices, alerts, and policies.