Entri Alert

Continuous endpoint monitoring

The EntriAlert agent runs as a Windows service, collecting telemetry from the operating system in real time. It observes process creation, network connections, file system activity, registry changes, and authentication events — the same data sources used by enterprise EDR platforms, delivered at a fraction of the cost.

Rule-based threat detection

Detection logic is built on a curated library of rules tuned specifically for SME and public sector environments. Rules are weighted to minimise false positives in real-world Windows estates — the kind of environments where legitimate admin tools, shared credentials, and legacy software are the norm, not the exception.

Plain-language alert delivery

When a rule fires, EntriAlert generates an alert written in plain English. Each alert includes what was detected, which device was affected, a severity rating, and a recommended action. Alerts are delivered by email. No security jargon, no raw log dumps, no SIEM required.

Minimal performance footprint

The agent is designed to be invisible in normal operation. It is engineered to consume minimal CPU and memory, making it suitable for deployment on older hardware, shared workstations, and devices running resource-intensive applications such as EPOS systems or CAD software.

No infrastructure dependency

EntriAlert does not require an on-premises server, a SIEM, or a dedicated security appliance. The agent communicates with the Cyber Sip cloud backend over an encrypted channel. All you need is a Windows device and an internet connection.

Encrypted telemetry pipeline

All telemetry collected by the agent is encrypted in transit using TLS 1.2 or higher and encrypted at rest in the Cyber Sip backend. No file contents, keystrokes, screen captures, or personal communications are ever collected. Only behavioural metadata is transmitted.

Credential-based attacks

• Brute-force and password-spray attempts against local and domain accounts
• Unusual authentication patterns — off-hours logins, new device access, repeated failures followed by success
• Credential dumping tool signatures (e.g. Mimikatz-style LSASS access patterns)

Persistence and privilege escalation

• New scheduled tasks or services created by non-administrative processes
• Registry run-key modifications associated with persistence mechanisms
• Unexpected privilege escalation events and UAC bypass patterns

Lateral movement indicators

• Unusual SMB or RDP connection patterns between endpoints
• Remote execution tool usage (PsExec, WMI, PowerShell remoting) from unexpected sources
• Pass-the-hash and pass-the-ticket indicators in authentication logs

Ransomware precursors

• Mass file rename or extension-change events consistent with encryption activity
• Shadow copy deletion commands (a near-universal ransomware pre-encryption step)
• Backup and recovery tool termination patterns

Command-and-control (C2) indicators

• Outbound connections to known malicious IP ranges and domains
• Beaconing patterns — regular, low-volume outbound connections at fixed intervals
• DNS queries for algorithmically generated domains (DGA indicators)

Suspicious process behaviour

• Living-off-the-land binary (LOLBin) abuse — legitimate Windows tools used maliciously
• Script interpreter (PowerShell, WScript, CScript) spawning unexpected child processes
• Process injection indicators and hollowing patterns