01Overview
One story instead of four consoles.
Phantom XDR includes everything in EDR and adds cross-domain correlation. Network, identity and email detections are joined with endpoint activity into storylines a person can follow.
- For
- Teams that need signals from more than the endpoint.
- Builds on
- Everything in Phantom EDR.
- Managed from
- Management console (in development)
- Platform
- Windows 10 and 11, x64
02Capabilities
What it covers.
- 01
Cross-domain correlation
Events from different sources are joined by correlation rules; incidents are scored and laid out as storylines.
- 02
Network detection
Beaconing, lateral movement, and DNS and TLS analysis.
- 03
Identity protection
Active Directory monitoring and credential protection.
- 04
Email threats
Email analysis and phishing-campaign correlation.
- 05
Automation
Local SOAR playbooks for automated response.
- 06
Analyst assistant
Incident summaries and query translation to shorten triage.
Every edition runs on the shared Phantom engine: the kernel sensor, real-time and exploit protection, ransomware defence and the emulator.
03Availability
Built on Phantom EDR.
Phantom is alpha software and there is no public installer yet. Release dates are not published; progress is visible in the repository, and builds will be announced here and on GitHub when they are ready.
If your organisation would like to follow Phantom XDR closely or discuss commercial licensing, we would like to hear from you.