K-EDR and Action Center
Watch the attack unfold, and respond to it
K-EDR collects useful events from computers, correlates them with recognised detection rules and groups alerts into incidents. The Action Center lets you respond in a few clicks.
The problem
Attackers increasingly use the system's legitimate tools. Without visibility into the chain of processes, an intrusion can go unnoticed for weeks.
What the module does
Targeted telemetry
Processes, network connections, library loads, persistence, scheduled tasks, PowerShell scripts.
Recognised rules
Compiled Sigma rules, correlation over time and systematic mapping to MITRE ATT&CK.
Readable incidents
Alerts are grouped into incidents with a timeline and an explanation.
Signed responses
Isolate, terminate a process, quarantine, collect evidence: every action is signed and logged.
Threat hunting
Queries across the whole fleet, saved queries and search for indicators of compromise.
How it works
Collection
The agent reports useful events, filtered at source.
Correlation
The rules detect suspicious sequences and create incidents.
Response
The analyst acts from the Action Center, with dual approval where needed.
What you should know
- The module is in development: Windows collection and the action centre are partly built.
- Collection on macOS depends on authorisation from Apple; a fallback is planned otherwise.
- Kayzen does not provide its own 24/7 SOC: a partnership is planned for phase 6.
Frequently asked questions
Questions about this module
Do I need a security team to use the EDR?
Incidents are explained simply and the Copilot assistant helps you understand them, but continuous monitoring requires a dedicated person or provider.
Are employees being monitored?
Telemetry covers processes and the system, not the content of documents. Using it in a business requires informing employees and, where applicable, the works council (CSE).
Practical cybersecurity guides
- Scams and threatsRansomware: the right reflexes before, during and afterPreventing ransomware, responding to an infection (isolate, don't pay, file a complaint) and getting back up. Practical advice for businesses and individuals.Read the guide
- RegulationNIS2: who is affected and where to start?Directive (UE) 2022/2555: sectors, size, essential and important entities, article 21 measures, incident reporting. Key points, with ANSSI references.Read the guide
- In the workplaceHit by a cyberattack: what to do in the first hourIsolate, alert, preserve evidence, don't pay, report (17Cyber, complaint, CNIL within 72 h): step-by-step guidance in the event of an incident.Read the guide
Want to try this module?
The pilot programme gives you access to modules as they are delivered, free of charge and with no commitment.