Detection
Detection on every Windows device
A signed agent on each Windows 10 and Windows 11 device watches processes, files, the registry, network connections, DNS lookups, PowerShell and the Windows security logs, and sends them to the Jetstone detection engine.
Rules you can read
Every detection rule names the MITRE ATT&CK technique it covers. Findings from one device or one account are grouped into one incident, with the evidence attached.
Every alert written up
Each incident comes with a plain-English account of what happened, written from its evidence alone. A checker rejects any write-up that names a process, file or account the evidence does not contain.
Tripwires on the device
Canary files and a burst detector for mass renames suspend the offending process tree on the device itself, without waiting for the cloud, then report what they stopped.
Works alongside the antivirus built into Windows
Jetstone checks that Microsoft Defender real-time protection is on and reads what Defender finds. It does not replace it.
No kernel driver
The agent is a signed user-mode service. It updates itself from a signed update channel and installs an update only when the signature verifies.
Posture on every check-in
BitLocker, Defender, the firewall, Remote Desktop, SMBv1, screen lock, local administrators and pending updates feed a health score for the whole fleet.
- Runs on
- Windows 10 22H2 and Windows 11, 64-bit.
- Installs with
- A signed MSI and an activation key, interactively or silently with msiexec.
- Buffers
- Up to 72 hours of telemetry on the device when it is offline.
Put Jetstone on your devices
Talk to Black Shard about Jetstone for your business.