integrations
Getting the answer into the tools you already run
Identification is only useful where decisions get made. There are three ways the answer travels: into your existing tools, into a report a person acts on, or into an action the agent takes itself.
one
Send it to the tools you already run
Working today.
Every completed analysis can be pushed out the moment it finishes.
- Webhook
- The full curated record, signed. Every delivery carries an HMAC signature and a timestamp, so the receiver can verify it came from us.
- Splunk
- Straight to HTTP Event Collector.
- Microsoft Sentinel
- Straight to the workspace.
- Elastic
- Direct index.
Your tools keep making the decisions they already make. They make them knowing what the file is.
Not yet: action back into an EDR. Telling a detection product to block something on our say-so is a different integration from sending it a record, and we have not built or tested it. When we have, this page will say so and name the products.
two
Put it in front of a person
Working today.
Every analysed file carries an approval status. An administrator reviews what the analysis found and decides: approve it, block it, or send it back for review.
Rules can carry the routine cases. Match on vendor, hash, software category, signing status, licence model or a minimum trust score, and matching files resolve without anyone reading them, so the queue holds the decisions that actually need a human.
three
Let the agent act on the decision
Working today. Off by default, deliberately.
The agent is a single Go binary for Windows, macOS and Linux, installing as a Windows service, a systemd unit or a launchd daemon. It already scans and uploads. It can also act.
When a file is blocked, its hash reaches the agent with the next policy fetch. In enforce mode the agent moves the file to quarantine, restricts it to read-only, records where it came from, and reports the action back. Nothing is deleted, and a quarantined file can be restored.
It ships in monitor mode and stays there until you change it. In monitor mode a blocked file is logged and left alone.
That default is the point, so here is exactly what backs it.
- A disconnected agent stops enforcing. If the policy has not refreshed in 24 hours, enforcement degrades to monitor on its own, because acting on a day-old decision is worse than not acting.
- Quarantine only reaches inside the folders you configured for scanning. System directories are refused outright.
- If a quarantine operation fails, the agent leaves the file alone rather than trying something more forceful.
- If approval evaluation errors, the result is that no rule matched. An error can never produce a block.
Why it is off rather than on. A confident wrong block on a real endpoint is worse than no action at all, and the analysis underneath these decisions is something we are still proving. Turning enforcement on is a decision you make deliberately, with monitor mode available first to see what would have happened.
This matters most where enforcement is already thin: an organisation with network controls but no endpoint agent, or coverage on some machines and not others. We are not only a layer that assumes you already own something to enforce with.
the record
What a record actually contains
This page used to show a result with six fields in it and present it as typical. It was not typical. It was what a record looks like when almost every question comes back unanswered.
A completed record on an ordinary signed executable carries all of the following. The example is illustrative rather than a real analysis.
- Identity
- What the file is, the product and vendor it belongs to, the format family it sits in, and a plain description of its purpose. Each carries a confidence, because a derived identity and a certain one are different things.
- Signing
- Whether it is signed, by whom, and whether the certificate chain and the timestamp hold up.
- Structure
- What the format reveals. Imports and what they imply about capability, sections and their characteristics, embedded resources, and the manifest with the privilege level it requests.
- The vendor as an organisation
- Who owns them, where they are, whether they are publicly held, roughly how large. A binary signed by a company acquired last year by an owner in another jurisdiction is a different fact from an unsigned one, and almost nothing on an endpoint surfaces it.
- Licence position
- Declared licence, the model it follows, and the obligations that attach to commercial use.
- Privacy posture
- What the vendor’s own published policy states about data sharing.
- Compliance mapping
- Which framework controls the finding touches.
- Indicators from the file alone
- Network destinations referenced, registry paths, file paths, and a timeline assembled from what is embedded. Nothing is executed to produce any of it.
- Reputation, when you have supplied a key
- Third-party engine results appear only if you have configured a provider. With no key configured the section is empty and says so, rather than reading as an all-clear.
Three surfaces, one answer
The portal for people who read reports, the API for systems that consume them, and the agent for machines that carry the software. All three return the same record, because there is only one analysis behind them.