Collate and harmonize inventory, vulnerability and misconfiguration, malware, exploit, network traffic information with technique-based detections for unified threat hunting that helps security teams gain insights into the true endpoint risks.

Threat hunting and investigation workflow based on multi-vector context of data.

Create rule-based alerts for automated, real-time notifications about security incidents with built-in workflows for reviewing actions or for taking appropriate suggested response. Alerting options include, email alerting, integration with ticketing systems, posting to Slack channels, creating PagerDuty incidents, and more.

Incident scoring engine intelligently prioritizes response based on how the attack is behaving in the network by leveraging the context of vulnerability, misconfiguration and network traffic data with other host telemetry data. This enables security analysts to respond to the most critical attacks first.

Gain valuable insights from exploitable vulnerabilities and misconfigurations on endpoints mapped to malicious attacks or MITRE tactics. This provides security teams with knowledge to protect all similar hosts. For example, if a malicious attack has occurred via a Firefox vulnerability, it will alert you to all hosts with that CVE.

Blocks attacks exploiting zero-day and unpatched vulnerabilities with techniques such as return oriented programming (ROP).

With zero-trust assumption, Qualys Multi-Vector EDR anti-malware protection disrupts suspiciously spawned processes on the endpoint, following the roll back.

Threat hunting and event investigation workflow enables security teams to take multifold actions such as:

• Quarantining or killing malicious file/process/registry/mutex
• Deleting malicious files and cleaning up the residuals

Enables the response lifecycle throughout the investigation phase, providing an intuitive workflow to quarantine the host and releasing it to the network once malicious objects are removed.

Easily tracks the status of all endpoints, letting you know if a certain host gets repeated malware or has been a part of multiple response processes.

Gain insights into all exploitable misconfigurations per MITRE tactics, with capability to “one-click” remediate throughout the entire global hybrid environment.

See all exploitable vulnerabilities affecting the endpoints.

Map malicious attacks back to the vulnerabilities that were exploited.

Detect available patches for vulnerabilities and deploy them using the same cloud agent with one click.

Prioritizes hosts with available patches based on vulnerabilities, open ports, and end-of-life software, mapped against real-time threat indicators such as malware family, high data loss, lateral movement, and more.

Preventive controls such as USB blocking to stop sensitive data leakage and malware infections.