Endpoint agent

A technology that provides continuous monitoring and analysis of system events on endpoint devices, such as employee laptops, company computers and servers, and virtualized workstations.

Overview What problems does it solve?Benefits Where is it used?

Overview

A unified software component installed on protected devices (computers, laptops, servers, and virtual workstations) that enables continuous monitoring and analysis of system events, detects attacks at early stages, and simplifies vulnerability detection.

Key agent capabilities

Collection of system events

The agent locally collects data about events on the endpoint device and sends it to detection modules. When forwarding events to a SIEM system, the agent normalizes them to reduce the load.

Detection of complex attacks at early stages

The agent performs static and behavioral threat analysis using an expert set of correlation rules and YARA rules.

Stopping malicious actions on nodes

The agent provides a wide range of actions for both predefined and interactive responses on the endpoint device.

Autonomous operation

The agent can analyze threats and automatically respond without internet access or communication with the management server, which is crucial for supporting remote devices and nodes with intermittent network connectivity.

Support for a wide range of OSs

The agent supports a wide range of international and country-specific operating systems, including Windows, Linux, and macOS. It can also operate in VDI environments.

Local device auditing for vulnerability detection and inventory

A single agent collects telemetry, configuration, and inventory data without requiring privileged accounts from the IT department. It then forwards this data to MaxPatrol VM for vulnerability detection. If MaxPatrol VM is not used, the agent still enables asset creation in the system.

Why use host agents?

Сформирована программа трансформации ИТ для построения результативной кибербезопасности.

Endpoint devices are a common attack vector

Attackers use phishing along with application and OS vulnerabilities to initiate attacks. Detecting such events early, before they spread across the network, is critical for organizational cyber resilience.

Распространение шифровальщиков, инфостилеров, вайперов, ВПО для удаленного управления

Spread of ransomware, infostealers, wipers, and RATs

Attackers use increasingly sophisticated tools designed to bypass traditional host-based defenses (such as AV and EDR). Static methods (for example, file signature analysis) are no longer sufficient. Attackers abuse legitimate tools (PowerShell, bash) to hide their tracks, persist in the network, and achieve their goals.

Security and IT teams rely on fragmented tools

Some systems require WinEventLog collectors, others need AuditD, and some demand additional accounts for data collection. This fragmentation requires time and expertise for setup, maintenance, and integration with monitoring systems.

Часть устройств находится вне сети или домена, вне зоны видимости средств защиты

Some devices are outside the network or domain, beyond security visibility

Devices of remote or traveling employees, as well as unmanaged devices, operate beyond IT visibility and do not send data to SIEM systems or vulnerability scanners.

Positive Technologies endpoint agent

More than just a sensor

Flexible configuration

Broad OS support

Delivery and installation modules

Collection modules

Detection modules

Response modules

Agents in Positive Technologies products

MaxPatrol EDR

Protection of an organization's devices against sophisticated and targeted attacks. MaxPatrol EDR provides:

Centralized agent management
Monitoring and response policy configuration via the web console
Dynamic threat detection (TTP analysis)
Automated and manual response

MaxPatrol VM

Comprehensive vulnerability management:

Agent-based scanning for devices outside the domain.
Parallel scanning reduces server/network load.
No privileged accounts needed, which simplifies collaboration between IT and security teams.

MaxPatrol SIEM

Expansion of the monitoring zone and instant response:

Centralized monitoring for all devices (including non-domain).
On-device behavioral and static analysis (correlation + YARA engines).
Response actions directly from event alerts.
Event normalization and filtering reduce the SIEM load.
Security teams can manage threats without IT involvement (policy-based).

PT Sandbox

Proactive detection of unknown threats:

Proactive detection of unknown malware distributed via Telegram, browsers, or P2P.
Agents detect downloaded files and submit them for in-depth analysis.
Analysis results are shared across all agents for preemptive blocking.

Thinking about the best way to protect your company?

During the consultation we'll propose a solution precisely tailored to your organization.