Skip to main content

Product overview

EDR Agent Monitor helps security teams detect, record, and review suspicious activity on Windows workstations and servers.

Core capabilities​

  1. Endpoint collection — Process, file, registry, and network signals (via Sysmon and the detection engine).
  2. Rule-based detection — JSON rules aligned with MITRE ATT&CK categories (execution, discovery, persistence, etc.).
  3. Central visibility — Events are sent to your AWS backend and appear in the web console.
  4. AI assistance — Automated analysis (classification, summary, MITRE hints) and follow-up chat on each event, powered by Amazon Bedrock.
  5. Optional enrichment — VirusTotal file-hash lookups where a hash is available.

URLs (production layout)​

PurposeHost
Documentation (this site)document.ravisarode.com
Operator console (dashboard)console.ravisarode.com

Your deployment may use different domains in development; configure DNS and HTTPS to match your environment.

How behavior is documented​

For how the product works (Sysmon → rules → upload → console, and every dashboard tab), see How it works and Console features—not only this overview.