Sees suspicious activity
CloudCastle follows programs, files, network connections and sign-in activity so it can spot an attack while it is happening.
CloudCastle Advanced EDR
See the behavior. Stop the attack.
CloudCastle watches what programs do, not just what they are called. When behavior looks dangerous, it gathers the evidence and can safely stop or isolate the threat under rules you control.
Behavior-first protection
Endpoint verdict
Explainable evidence, bounded response
The short version
What Advanced EDR does for you
It watches each computer, recognizes attack behavior and responds without handing unlimited control to AI.
Checks more than a name
It combines trusted security rules with behavior and threat intelligence, helping it catch both known malware and new attacks.
Stops damage safely
Approved policies can stop a malicious process, quarantine a file or isolate a computer. Every action is recorded and protected by safety controls.
Detection architecture
The model advises. The safety system decides.
High-confidence deterministic detections remain the source of truth. AI ranks evidence and helps technicians reason faster, but it cannot bypass policy.
Native telemetry
Platform sensors emit normalized process, file, network and DNS events through one hardware-abstraction contract, so the detection core does not need platform-specific exceptions.
Rules and behavior
Sigma rules, YARA-X content scanning, IOC matching, process ancestry, ransomware canaries and tamper checks corroborate one another instead of depending on a single signature.
AI-assisted risk
A stable feature vector captures temp execution, shell chains, download-to-interpreter behavior, C2 ports, IOC hits and canary trips. Advisory scoring ranks the queue after policy has decided.
Gated containment
Process kill, process-tree containment and file quarantine pass through allowlist, kill-switch and dry-run gates. Network isolation follows the control plane’s own deterministic authorization path.
Evidence and ancestry
Every detection carries its rule, severity, image, process ID, policy decision, execution result and bounded process ancestry, with author and references preserved from the rule source.
Rule health and ATT&CK
Per-rule firing counters and MITRE ATT&CK technique rollups show what is covered, what actually fired and when, making blind spots measurable instead of assumed.
Native operating-system security
Use the telemetry the OS already knows best
One portable detection core sits above native collection paths. If a privileged sensor is unavailable, the agent degrades visibly rather than pretending coverage exists.
ETW and Security Center awareness
Event Tracing for Windows collects process execution, network connections and DNS queries from Kernel-Process, Kernel-Network and DNS-Client providers.
CloudCastle reads Windows Security Center’s public product list to understand the antivirus, antispyware and firewall products already present.
Coexistence is deliberate: CloudCastle never directly disables Microsoft Defender or Tamper Protection. Native WSC product registration requires Microsoft Virus Initiative membership and is not claimed today.
Endpoint Security Framework
Apple’s Endpoint Security Framework provides real-time process-execution telemetry through the same system API used by commercial endpoint products.
Where entitlement, root or TCC approval is unavailable, a libproc process-table poller provides a lower-privilege fallback so new executables remain visible.
The agent reports which tier is active; fallback coverage is never mislabeled as full Endpoint Security coverage.
eBPF, tracepoints and LSM
An eBPF sensor attaches to the process-exec tracepoint and, where supported, BPF-LSM file-open and socket-connect hooks. Network collection can fall back to a TCP-connect kprobe.
Ring-buffer events are normalized without blocking the kernel path. On-demand memory inspection uses /proc/<pid>/maps and /proc/<pid>/mem.
Unavailable kernel features fail open and report their degraded state rather than stopping the machine or the agent.
Defense in depth
Signals that cover different failure modes
A signature can name known malware. Behavior, provenance and live telemetry can expose what nobody has named yet.
Behavioral rules
Portable Sigma detections map normalized endpoint events to ATT&CK-tagged techniques. Offline validation rejects rules that reference fields the sensor can never emit.
Content inspection
Owned and vendor YARA packs inspect file-bearing events. Broken packs degrade loudly and do not prevent the rest of the pipeline from running.
Canaries and burst behavior
Write-intent touches of protected honeyfiles create high-signal alerts. Multiple distinct trips inside a short window escalate to a critical active-ransomware verdict.
Live IOC matching
Hash, IP, domain and path indicators can be loaded or hot-swapped without restarting the agent. Matches are indexed for constant-time lookup and recorded as explicit evidence.
On-demand process scanning
Platform readers support bounded process-memory scans and return explicit unsupported or denied states. The scanner does not hide a privilege failure behind a clean verdict.
Process-tree context
Bounded ancestry links the suspicious child to the shell, document reader, installer or parent process that launched it, preserving the path from initial execution to detection.
Agent self-protection
Protected agent paths and allowed process IDs make modification attempts visible. The same bounded telemetry store exposes recent tamper activity to the management plane.
CISA KEV and NVD
Normalized CISA Known Exploited Vulnerabilities and NVD data is matched against installed-package inventory, separating actively exploited exposure from ordinary backlog.
USB awareness
Attach detection adds removable-device context to the endpoint record, helping technicians investigate the physical path behind a suspicious file or process.
AI with boundaries
Faster judgment without unbounded autonomy
CloudCastle separates evidence, ranking and enforcement so a model failure cannot silently become an endpoint action.
- Stable features: the same named signals feed the local advisory scorer and the out-of-process model boundary, preventing training and runtime extraction from drifting apart.
- Post-decision scoring: risk is computed after the response dispatcher returns; the dispatcher has no score parameter and cannot read it.
- AI technician escalation: high-confidence incidents can be summarized and planned in the control plane, while every proposed playbook still passes an allowlisted deterministic gate.
- Human-readable evidence: rule, ancestry, IOC, canary, action and outcome remain available even when AI services are unavailable.
Response safety
Automated response should be hard to misuse
The same gate order applies to every endpoint action, including actions triggered through a partner or management workflow.
Unchecked automation
- A confidence score becomes permission
- One false positive kills a trusted process
- No global stop control
- An alert says what was detected, not what changed
CloudCastle response path
- Trusted path or hash allowlists short-circuit first
- A local kill-switch stops all enforcement
- Dry-run remains the safe default until policy enables action
- Kill, containment and quarantine outcomes are written to telemetry
Put behavior-first protection on one endpoint
Start with a single computer, inspect the evidence and policy decisions, then expand with the same cross-platform control plane.