A Citadel product
Eagle Eye
Endpoint security for the BlackVault family.
In development
Eagle Eye is the BlackVault family’s endpoint security agent. The first version watches Windows PCs and the NAS for the marks attackers leave behind, and e-mails you an alert within about a minute.
Version 1, built and not yet released
What it watches for today
Antivirus turned down
Notices when antivirus protection is turned down or exclusions are added.
New startup items and scheduled tasks
Notices new startup items and new scheduled tasks.
Installers run from a web address
Notices installers that are run straight from a web address.
Programs in unusual folders
Notices programs running from unusual folders.
Cleared logs
Notices when logs are cleared.
Unusual uploads
Notices unusual uploads.
Bait files on the NAS
Notices when bait files on the NAS are touched.
Alerts
How alerts work
- It watches. Eagle Eye keeps an eye on Windows PCs and the NAS for the marks listed above.
- It e-mails you. When it sees one, it sends an e-mail alert within about a minute.
- You decide. Eagle Eye is alert-only. It tells you, and it does not block or repair anything on its own.
Coming next Roadmap
These are plans. None of them is available today.
- Machine health and posture checks: OS support, disk encryption, Secure Boot and TPM, BIOS and microcode, hardware errors, NAS temperature.
- One-tap approved repair playbooks.
- macOS.
- Prevention through the built-in enforcement of Windows and macOS.
- Isolating an infected machine.
Honest limits
- Eagle Eye is in development and is not installed anywhere yet.
- It alerts. It does not block yet.
- It covers Windows PCs and the NAS. macOS is on the roadmap, not available.
- It looks for the marks listed above. It does not promise to catch everything.