Centeye Ironwatch™ — managed endpoint detection & response, with the whole attack story attached.

Behavior-based detection, mapped to MITRE ATT&CK

Modern intrusions arrive as behavior — an encoded PowerShell command, a credential store being read, persistence quietly established, the built-in antivirus switched off. Centeye’s detection engineering is behavior-first, so the technique is caught even when the tooling is novel.

• Ransomware canaries — tripwire files no legitimate process should touch; first modification starts containment.
• Behavioral rules — obfuscated script execution, credential access, persistence via scheduled tasks, services and run-keys, and security-tool tampering, each mapped to its ATT&CK technique.
• Malware verdicts — YARA rules, hash reputation, and sandbox-detonation analysis on suspicious files.
• File integrity & Defender health monitoring — critical-path change detection, and an alert the moment built-in Windows protection is disabled (routinely an attacker’s first move).
• Learned-benign suppression — the platform learns each client’s legitimate admin tooling and suppresses it from the queue, with a human approving every suppression. False-positive volume is a managed number, not an accident.

behavior-based · ATT&CK-mapped · tuning is a documented process

XDR correlation: one incident per attack

The endpoint alert is usually step three: a phishing email harvested credentials, the credentials opened a session, then the payload ran. Point tools file three tickets in three consoles. Centeye keys every signal to the same user and device and correlates them into one incident with one timeline — your analyst reads one record and approves one response.

cross-surface correlation · endpoint + identity + email

Containment you can defend in a post-incident review

Every response action is policy-scoped, reversible where the platform allows, written to a tamper-evident audit log, and re-checked against actual machine state after execution — “done” means verified, not assumed.

• Automated host isolation — contains a device the moment behavior confirms, in seconds; release is one click when it’s clean.
• Process termination · file quarantine & restore · persistence removal — the attacker’s footholds removed, reversibly.
• Forensic collection — memory capture and a one-click investigation package from the live host, preserved for review.
• Pre-emptive backup trigger — on ransomware behavior, Centeye fires the client’s own backup product for a clean restore point before encryption spreads.
• Guardrails — destructive actions default to approval; newly enrolled endpoints carry a cool-off period during which destructive steps park to manual.

post-action verification · reversible · audited