Skip to main content
Ollandi
Request a demo

Endpoint security · Domain Intelligence Pack

Endpoint DIP

Monitor endpoint processes, users, files, software changes, connections, and device health in wider infrastructure context.

Evaluate the Endpoint DIP

Overview

From domain evidence to a decision operators can use

What the Endpoint DIP monitors, detects, explains, and makes possible.

  • The Endpoint DIP keeps live endpoint security state, with source and time preserved.

    • Process and parent-child execution
    • User sessions and privilege
    • Files, persistence, and configuration changes
    • Software lineage and network connections

  • Findings assessed for security exposure and service impact.

    • Suspicious execution and persistence
    • Credential or session misuse on a host
    • Unexpected software or configuration drift
    • Endpoint behavior linked to wider attack activity

  • Review the relationships and supporting evidence behind a finding.

    • Who initiated the process and from which session
    • Whether software and behavior are expected
    • Which services, identities, and destinations are connected
    • The smallest safe containment scope

  • Domain actions Ollandi can propose, each checked against policy before it runs.

    • Preserve host and process evidence
    • Restrict a process or connection
    • Revoke suspicious sessions
    • Isolate a device within approved bounds
    How controlled response works

Example investigation

How the Endpoint DIP moves from signal to verified outcome

Follow an illustrative condition through the domain signals, assessment, proposed response, and verification.

  1. Observe

    A managed endpoint launches an unusual process after a software change.

  2. Interpret

    Ollandi compares software lineage, user session, file changes, network activity, and neighboring devices.

  3. Contain

    Process, connection, session, or device-level action is selected according to confidence and policy.

  4. Verify

    Device health and connected service state are confirmed after action.

Coverage

The context this pack brings into Ollandi

Evidence keeps its source and time. Ollandi relates it to other packs, service dependencies, policy, authority, and history.

  • Endpoint and process telemetry
  • User and session records
  • File and configuration changes
  • Software inventory and lineage
  • Network destinations
  • Asset ownership and service context
Review the architecture

Domain Intelligence Packs

Add depth in other domains

Every pack feeds the same shared state, so evidence from one domain can support or challenge another.

See all packs

Domain Intelligence Pack

Cloud DIP

Monitor cloud control planes, identities, resources, posture, and exposure as one changing security state.

Learn more

Domain Intelligence Pack

Identity DIP

Monitor human and machine identity, sessions, credentials, privilege, and access behavior across infrastructure.

Learn more

Domain Intelligence Pack

Runtime DIP

Monitor live workload execution and connect process behavior to images, deployments, identities, network paths, and services.

Learn more

Domain Intelligence Pack

Network DIP

Monitor communication paths, segmentation, service reach, and movement across cloud, campus, data center, and hybrid networks.

Learn more

Domain Intelligence Pack

On-premises DIP

Monitor private infrastructure, directories, virtualization, storage, databases, configuration, and hybrid dependencies.

Learn more

Domain Intelligence Pack

ATM DIP

Monitor ATM availability, dispensing, cash, hardware, communications, security events, vendors, and service obligations.

Learn more

FAQ

Frequently asked questions

  1. The endpoint tool can supply process, file, session, and connection telemetry. Where supported and authorized, it also provides the enforcement path for a response.

  2. The process is related to its parent, user session, software change, network destinations, and connected services. These relationships help assess legitimate installation activity and suspicious execution.

  3. Use an incident with process lineage, software history, user context, and network activity. Assess whether a process, session, connection, or host intervention is proportionate.

Get started

Evaluate the Endpoint DIP

Bring a host incident with process lineage, user activity, and software changes for review.

Contact sales