Endpoint detection, investigation and response on your own infrastructure with Wazuh, Velociraptor, osquery and Falco, and how coverage, response actions and forensic needs differ by sector and framework.
When ransomware hits: using Velociraptor to collect triage data and hunt across all endpoints, offline collectors for hosts without agents, preserving evidence for insurers and law enforcement, and feeding findings back into Wazuh detections.
Endpoint detection for containers: Falco on each node with the eBPF driver, rules for shell access and privilege escalation, forwarding events to Wazuh or the SIEM, and why detection needs a separate response path.
Running Wazuh and Velociraptor where endpoints and servers have no internet: offline installation, offline vulnerability data, updating rules and artifacts by media transfer, and storing endpoint telemetry inside the enclave.
Checking an acquired company's endpoints for existing compromise before connecting networks: deploying Velociraptor or offline collectors across their estate, hunts for persistence and credential theft, and reporting results to deal teams.
Clinical workstations, servers running EHR components and devices that cannot take agents: Wazuh coverage on supported systems, monitoring legacy hosts through logs, alert handling with small teams and HIPAA audit evidence.
Banks need endpoint detection, investigation records and evidence for regulators and insurers. This page covers Wazuh rules and active response, Velociraptor hunts, 24x7 triage staffing and where commercial EDR still sits alongside.
Agencies that must keep endpoint telemetry on government systems: self-hosted Wazuh and Velociraptor, coverage for Windows, Linux and legacy Unix, integration with central SOCs and data retention.
Engineering workstations and HMIs often run old Windows versions and cannot tolerate heavy agents. This page covers lightweight monitoring, file integrity checks, safe response actions and coordinating with OT vendors.
PCI DSS requirement 5 covers anti-malware on system components and its monitoring. This page covers what Wazuh malware detection, YARA and ClamAV integration can evidence, where a dedicated anti-malware product is still needed, and the periodic evaluation for systems deemed not at risk.
What SOC 2 auditors typically expect for endpoints under CC6 and CC7, and how Wazuh, osquery-based Fleet policies and disk encryption checks provide device evidence across a Type 2 period.
CIS Control 10 asks for anti-malware deployment, automatic signature updates, central management and behavior-based detection. This page maps each Safeguard to open-source endpoint tools and states which need commercial products.
Defense contractors must report cyber incidents within 72 hours, submit malware and preserve images for DoD. This page covers using Velociraptor collections and evidence handling to meet those obligations.
Requirements for endpoint detection and response: OS coverage, telemetry depth, detection content and tuning, response actions, forensic collection, offline hosts, management at scale, retention and integration with the SIEM and SOAR.
Questions for EDR vendors, MDR providers and implementation partners: detection coverage and testing, response actions and safeguards, agent footprint, data location, 24x7 triage, forensic support and how detections are tuned over time.
Cost of open-source endpoint detection run in-house or by a partner compared with per-endpoint commercial EDR or MDR: servers and storage, detection engineering, 24x7 monitoring staff, incident response retainers and support subscriptions.
Tell us what you're working on, whether it's a deployment, an audit, a security test or a cyber range. You'll speak with an engineer who can help you scope it.