Vorpsel / Products / Endpoints
EDR and antivirus
One lightweight agent on Windows, Linux and macOS scans for malware, follows what runs on each machine and lets your team quarantine a file or isolate a machine from the console. No other security software to install.
At a glance
- Malware scanning on a schedule you set per group of machines
- Known malware at launch every program fingerprinted as it starts
- Activity monitoring programs, connections and file changes
- Response quarantine, end a process, isolate a machine
- 6 MB on disk, one program and one service
Three layers on every machine
Antivirus catches what is already known. Endpoint detection catches what behaves wrong. You get both, from the same agent and the same console.
Malware scanning
Files are checked against signatures that Vorpsel keeps up to date, on a schedule you set per group of machines.
Known malware at launch
Every program that starts is fingerprinted and compared with public lists of known malware, so a known threat raises a critical alert the moment it runs.
Activity monitoring
Programs started, network connections and changes to important files are recorded and checked by detection rules, and stay searchable for your investigations.
What is included
Scanning that fits your machines
A full scan of a busy server at the wrong hour is a problem of its own. Each group of machines has its own settings, so servers and laptops are treated differently.
- Scheduled scans of the folders you choose, at low priority
- Scan a machine now, from the console, when an alert needs it
Detection of suspicious behavior
New malware has no signature yet. The agent records what happens on the machine and detection rules look for the behavior of an attack, such as an office document starting a command shell or a program run from a temporary folder.
- Every program started, with its command line, its parent and its fingerprint
- Network connections and DNS lookups on Windows, with the program that made them
- Connections to addresses and domains known to be used by attackers
- Alerts mapped to MITRE ATT&CK, so you know what stage of an attack they suggest
Act from the console
When an alert needs action, your team acts on the machine without logging in to it. Every action is signed and recorded with who did it, and the containment ones can be undone.
- Quarantine a file or restore it, if it was blocked by mistake
- End a process that is still running
- Isolate the machine from the network, keeping only its connection to Vorpsel
- Block an address on that machine
A protected quarantine
Quarantined files are stored in a protected form, so other security tools do not delete them and a file blocked by mistake can always be put back.
- The original owner and permissions are restored with the file
- The quarantine folder can only be read by the system administrators
Light enough to forget it is there
Install with one command per system and see every machine on the board within minutes.
Questions
Can it replace our current antivirus?
It covers malware scanning, detection at launch and response from the console. Whether it can replace your current product depends on what you use today and on your compliance requirements; during a trial you can run both side by side and compare.
What happens if a file is quarantined by mistake?
Restore it from the console. The file goes back to its original place with its owner and permissions, and the restore is recorded with who did it.
Does isolating a machine cut it off from the console?
No. An isolated machine can only talk to Vorpsel, so your team can still investigate it and release it when it is safe.
Which systems are supported?
Windows, the main Linux distributions and macOS, with the same agent used for vulnerability management and the SIEM.
Related products
Protect the first machines today.
Install with one command per system and see every machine on the board within minutes.