Three layers on every machine

Antivirus catches what is already known. Endpoint detection catches what behaves wrong. You get both, from the same agent and the same console.

Malware scanning

Files are checked against signatures that Vorpcel keeps up to date, on a schedule you set per group of machines.

Known malware at launch

Every program that starts is fingerprinted and compared with public lists of known malware, so a known threat raises a critical alert the moment it runs.

Activity monitoring

Programs started, network connections and changes to important files are recorded and checked by detection rules, and stay searchable for your investigations.

What is included

Scanning that fits your machines

A full scan of a busy server at the wrong hour is a problem of its own. Each group of machines has its own settings, so servers and laptops are treated differently.

Scheduled scans of the folders you choose, at low priority
Scan a machine now, from the console, when an alert needs it

Detection of suspicious behavior

New malware has no signature yet. The agent records what happens on the machine and detection rules look for the behavior of an attack, such as an office document starting a command shell or a program run from a temporary folder.

Every program started, with its command line, its parent and its fingerprint
Network connections and DNS lookups on Windows, with the program that made them
Connections to addresses and domains known to be used by attackers
Alerts mapped to MITRE ATT&CK, so you know what stage of an attack they suggest

Act from the console

When an alert needs action, your team acts on the machine without logging in to it. Every action is signed and recorded with who did it, and the containment ones can be undone.

Quarantine a file or restore it, if it was blocked by mistake
End a process that is still running
Isolate the machine from the network, keeping only its connection to Vorpcel
Block an address on that machine

A protected quarantine

Quarantined files are stored in a protected form, so other security tools do not delete them and a file blocked by mistake can always be put back.

The original owner and permissions are restored with the file
The quarantine folder can only be read by the system administrators

Light enough to forget it is there

Install with one command per system and see every machine on the board within minutes.

6 MBon disk, one program and one service

25 MBor less of memory in normal operation, at low priority

1agent for vulnerability management, SIEM and EDR

Questions

Can it replace our current antivirus?

It covers malware scanning, detection at launch and response from the console. Whether it can replace your current product depends on what you use today and on your compliance requirements; during a trial you can run both side by side and compare.

What happens if a file is quarantined by mistake?

Restore it from the console. The file goes back to its original place with its owner and permissions, and the restore is recorded with who did it.

Does isolating a machine cut it off from the console?

No. An isolated machine can only talk to Vorpcel, so your team can still investigate it and release it when it is safe.

Which systems are supported?

Windows, the main Linux distributions and macOS, with the same agent used for vulnerability management and the SIEM.

EDR and antivirus