Endpoint Detection and Response (EDR)
Antivirus stops known malware. EDR stops everything else. Watch the process tree, catch living-off-the-land attacks and roll back changes from a browser console.
Antivirus vs EDR
| Capability | Traditional AV | WatchTower EDR |
|---|---|---|
| Signature matching | Yes | Yes |
| Behavioural analysis | Limited | Full process tree |
| Real-time telemetry | No | Sub-minute |
| Threat hunting | No | Built-in |
| Rollback / remediation | No | One-click |
| API for SOAR / SIEM | Rare | Full REST API |
What WatchTower EDR collects
Every endpoint runs a lightweight agent (15–25 MB RAM) that streams:
- Process trees — every process creation, parent-child relationship, command line and hash.
- Network connections — remote IPs, ports and timestamps.
- File changes — new executables, scripts and persistence mechanisms.
- Registry modifications — Run keys, service entries, WMI subscriptions.
Detections that catch real attacks
- PowerShell downloading a payload from a newly registered domain.
- A Word macro spawning cmd.exe and then mshta.exe.
- LSASS being read by a process that is not a debugger.
- A scheduled task persisting with an encoded command line.