01Overview
What a responder needs, on every endpoint.
Phantom EDR keeps everything in the engine and adds the tools of an investigation: recorded telemetry, threat hunting, incident response and forensic collection. A central management console is in development.
- For
- Security and IT teams responsible for fleets of Windows endpoints.
- Managed from
- Management console (in development)
- Platform
- Windows 10 and 11, x64
02Capabilities
What it covers.
- 01
Endpoint telemetry
Activity is recorded locally on each endpoint and kept queryable for investigation.
- 02
Threat hunting
Scheduled hunts and indicator sweeps across endpoints.
- 03
Incident response
Related alerts are correlated into incidents, with containment and remediation actions.
- 04
Live response
Inspect processes, files and the registry on a live endpoint.
- 05
Forensics
Memory capture, timelines and evidence collection.
- 06
Playbooks
Repeatable response procedures instead of one-off clicks.
- 07
Policy and device control
Central policy, including rules for removable devices.
- 08
Exposure
Vulnerability and patch assessment, with asset and software inventory.
- 09
Compliance
Configuration checks and hardening guidance.
- 10
Local sandbox
Suspicious files can be detonated in isolation on the endpoint.
- 11
Reporting
Incident reports and executive summaries.
Every edition runs on the shared Phantom engine: the kernel sensor, real-time and exploit protection, ransomware defence and the emulator.
03Availability
Built on the same engine as Phantom Home. The management console is in development.
Phantom is alpha software and there is no public installer yet. Release dates are not published; progress is visible in the repository, and builds will be announced here and on GitHub when they are ready.
If your organisation would like to follow Phantom EDR closely or discuss commercial licensing, we would like to hear from you.