Password guessing on a server
Failed remote sign-ins cross the threshold, the on-call technician gets a phone call, and a ticket is opened automatically.
ExaGuards EDR · Endpoint Detection & Response
Endpoint Security That Detects, Blocks And Responds
ExaGuards EDR watches every managed endpoint for the signs of trouble, from disabled antivirus and new administrator accounts to cleared security logs and unapproved software, then alerts the right person, blocks what should not run and turns incidents into tickets.
17 Windows event detections
Software blocking
Alert to ticket in one step
DETECT · BLOCK · ALERT · RESPOND
Most Incidents Leave Signs. ExaGuards Makes Sure Someone Sees Them.
Attacks and accidents rarely happen without warning. Antivirus is switched off, an unknown account joins the administrators group, someone tries hundreds of passwords, the security log is cleared. On their own these events are buried in Windows; together they tell you something is wrong.
ExaGuards EDR collects those signals from every endpoint, applies your alert rules, and gets the right alert to the right person by SMS, phone call, app notification, email or Teams, with reminders until someone acknowledges it. Unapproved software is stopped before it runs, and any alert can open a support ticket automatically.
It runs on the same agent as ExaGuards RMM, so the technician who receives the alert can investigate and fix it from the same screen.
17Windows event detections, plus your own
16health and security alert rules
3severity levels: Info, Warning, Critical
~100Windows programs protected from accidental blocking
WINDOWS EVENT DETECTIONS
17 Built-In Security Event Rules
Each rule fires when an event happens a set number of times within a window you choose, from 1 minute to 24 hours.
| Detection | What it watches |
|---|---|
| Failed remote sign-ins | Security event 4625 for network and RDP logons: password guessing from outside. |
| Failed sign-ins for one account | Security event 4625 for a single account. |
| Account locked out | Event 4740. |
| Remote Desktop sign-in | Remote Desktop session events 21 and 25. |
| New user account | Event 4720. |
| User added to administrators | Events 4732, 4728 and 4756 (local, global and universal admin groups). |
| Event log cleared | Security 1102 and System 104. |
| Audit policy changed | Event 4719. |
| New service installed | Event 7045, a common persistence technique. |
| Malware detected (Defender) | Events 1116, 1118 and 1119. |
| Defender protection turned off | Events 5001, 5010 and 5012. |
| Unexpected shutdown | Event 6008. |
| Blue screen | Windows Error Reporting 1001. |
| Disk errors | Disk events 7, 11, 15, 51, 52 and NTFS 55. |
| Service crashed | Events 7031 and 7034. |
| Program crashed or froze | Events 1000 and 1002. |
| Any Windows event | Your own rules in the form Log:IDs@Provider, up to 10 lines of 50 event IDs. |
ALERT CENTER
Health And Security Rules With Sensible Defaults
Every rule has a default threshold you can change, and can apply to everyone, one client or one computer.
The agent3
- Agent offline (default 15 minutes)
- Agent never checked in
- Whole site offline: holds back the per-computer noise
Disks4
- Low free space in % or GB
- Disk health problem (SMART)
- Disk running hot (over 60 °C)
Services & programs3
- Service stopped
- Program not running
- Program using a lot of memory
Security3
- Antivirus off or missing
- Antivirus out of date
- Firewall off
The computer4
- Restart waiting
- Not restarted for a long time
- High CPU or memory use, averaged over time
Starter packs21
- General pack of 13 rules
- Windows events pack of 8 rules
- Switch on a sensible baseline in one step
SOFTWARE BLOCKING
Stop Unapproved Software Before It Runs
A block rule targets a software in the catalogue, so every version is covered, including versions installed later. ExaGuards finds its programs by name and install folder and stops them from starting.
- Scope: every agent, one client, one group or one computer
- Enforcement: the program never starts; optionally close it if running now and uninstall it
- Safe by design: about 100 Windows and agent programs can never be blocked, and generic names like setup.exe are skipped
- Clear message: "Blocked by ExaGuards: your IT administrator has blocked it"
- Status per computer: enforced, waiting, partial, failed or protected
- Grid filters: blocked, blocked but still installed, not confirmed yet
RESPOND
From Alert To Action
| Feature | Details |
|---|---|
| Notification channels | SMS, email, phone call, app notification, Microsoft Teams, webhook or an automatic support ticket, per rule or company-wide. |
| Reminders | Remind every 5 minutes to 7 days, stop after a set number or keep reminding until it clears; reminders stop when someone acknowledges. |
| Alert to ticket | Open a ticket with the right status, urgency, employee and team, and move it automatically when the alert clears by itself. |
| Maintenance windows | Pause alerts once (up to 31 days) or weekly, for everyone, a client or a computer, including from a bulk action. |
| Alert Center | Active, resolved and all alerts, with acknowledge and resolve, and a record of who did what. |
| Company settings | Minimum severity to notify, notify when an alert clears, and snooze. |
INVESTIGATE
Security Audits At Your Fingertips
22 Users & security commands plus related checks run in one click from any computer.
Accounts & sign-ins
- Local users and administrators
- Recent successful and failed sign-ins
- Account lockouts, password policy
Protection status
- Defender status, detections, exclusions
- Registered security products
- Firewall status, UAC settings
Hardening
- SMB 1.0, TLS/SSL protocol settings
- Credential protection, audit policy
- Unquoted service paths, automatic sign-in
Encryption & boot
- BitLocker and TPM status
- Boot mode and Secure Boot
- Certificates about to expire
Remote access
- Remote Desktop security
- Other remote-access tools present
- Remote management readiness
Response actions
- Run a Defender quick scan
- Update Defender signatures
- Purge Kerberos tickets
EVIDENCE
DNS Activity And Screen Recording
| Feature | Details |
|---|---|
| DNS Activity | Every name each process looks up on a computer, collected from Windows' own DNS tracing with no packet driver. Overview with totals, top domains and processes and an hourly timeline, a live log, and a watchlist that raises alerts on the domains you choose. |
| Screen recording | Scheduled recording per computer: capture every 2 to 300 seconds, picture quality, all screens or the main screen, all the time or on a schedule, with each agent following the default or its own settings. Every viewing of a recording is logged. |
| AI screen rules | Describe a forbidden action in plain words and ExaGuards flags it with screenshot evidence for review. ExaGuards AI → |
CLEAR ABOUT WHAT IT DOES
Designed To Work With Your Antivirus
ExaGuards EDR monitors and acts on the security state of each endpoint: it watches Windows Defender or your antivirus, the firewall, the event logs and the software that runs. It is designed to sit alongside your antivirus, making sure it stays on and up to date and that its warnings reach a person.
We are happy to walk through exactly how ExaGuards EDR fits with your existing security tools during a demo.
IN PRACTICE
What ExaGuards EDR Catches
Antivirus switched off
Defender protection turned off on a reception PC raises a critical alert within minutes, not at the next audit.
Someone adds an admin
A user added to Domain Admins triggers an alert with the computer and event details.
Covering tracks
A cleared security log is flagged immediately as a critical event.
Unapproved tools
Torrent clients and unapproved remote-access tools are blocked on every computer of a client.
No false alarms
A maintenance window pauses alerts while servers restart for planned work.
Is ExaGuards EDR the same as antivirus?
No. It works alongside your antivirus: it watches that protection stays on and up to date, detects suspicious Windows events, blocks unapproved software and makes sure every warning reaches a person and becomes a ticket.
Which events can it detect?
17 built-in detections, including failed sign-ins, lockouts, new administrators, cleared logs, new services, malware detected and protection disabled, plus your own rules for any Windows event ID.
Can I block software on some computers only?
Yes. Block rules apply to everyone, one client, one group or one computer.
Could a block rule break Windows?
About 100 Windows and agent programs are protected and can never be blocked, and generic installer names are skipped.
How are alerts delivered?
SMS, phone call, app notification, email, Microsoft Teams or webhook, with reminders until acknowledged, and they can create tickets automatically.
Can I silence alerts during planned work?
Yes, with one-off or weekly maintenance windows for everyone, a client or a computer.
Does it need a separate agent?
No. ExaGuards EDR uses the same agent as ExaGuards RMM.
THE EXAGUARDS PLATFORM
Works Even Better Together
Every product line shares the same clients, devices, people and login.
ExaGuards RMM
Monitor, manage and fix every Windows computer and server.
Explore →ExaGuards Network
Discover, document and manage everything on the network.
Explore →ExaGuards Uptime Monitor
36 check types from the cloud or inside the network.
Explore →ExaGuards Service Desk
Tickets, email, SMS and alert notifications.
Explore →ExaGuards Docs
Credentials vault, knowledge base and diagrams.
Explore →ExaGuards Business
Orders, estimates, invoices and bookkeeping.
Explore →ExaGuards HR
Timesheets, overtime, payroll hours and requests.
Explore →ExaGuards Insights
Productivity reports and live screens.
Explore →GET STARTED
See What ExaGuards Can Do For You
Tell us about your team and the devices you support. We will prepare a quote for the product lines you need and walk you through them in a live demo.
