How It Works
From install to alert — no security team required
EntriAlert is designed to be deployed by a business owner or IT generalist in under an hour. Here is exactly what happens once it is running.
Step-by-Step Walkthrough
Four steps from installation to protection
Install the lightweight agent
A small background service is installed on each Windows device you want to monitor. It requires no special hardware and has a minimal performance footprint.
The EntriAlert agent runs as a Windows service. Installation takes a few minutes per device and can be scripted for bulk deployment across multiple machines. The agent does not require inbound firewall rules — it communicates outbound only, reducing your attack surface rather than expanding it.
Compatible with Windows 10 and Windows 11. Windows Server support is on the roadmap. The agent runs with least-privilege permissions and does not require admin rights after initial installation.
Continuous endpoint monitoring begins
Once installed, the agent monitors process activity, file system changes, network connections, and user account events — continuously, in the background.
The agent collects telemetry from the Windows event log, process creation events, network socket activity, and file system operations in designated sensitive paths. This data is processed locally before being transmitted, reducing bandwidth usage and keeping sensitive file contents off the wire.
Telemetry is collected via Windows ETW (Event Tracing for Windows) and the Windows Security Event Log. No kernel-mode drivers are used in the current Beta.
Rule-based detection flags anomalies
A curated set of detection rules runs against the incoming telemetry stream. When a pattern matches a known threat behaviour, an event is raised.
Detection rules are maintained by the Cyber Sip team and updated as new threat patterns emerge. Current rules cover common attack techniques including suspicious process chains, lateral movement indicators, credential access patterns, and known malware execution signatures. Rules are written to minimise false positives in typical SME environments.
The current detection engine is rule-based, not ML-driven. Behavioural baseline modelling and ML-assisted anomaly detection are on the roadmap. All rules are versioned and auditable.
Alerts and decision support delivered
When a detection fires, an alert is sent to the designated recipient — the business owner, IT lead, or both. Alerts are written in plain language with clear next steps.
Each alert includes: what was detected, which device and user account was involved, a severity rating, and a recommended action. The goal is to give a non-specialist enough context to make a confident decision — whether that is isolating a device, changing a password, or calling an IT professional. No alert requires a security analyst to interpret.
Alerts are delivered via email in the current Beta. Dashboard and webhook delivery are on the roadmap.
Under the Hood
How the agent and platform fit together
EntriAlert has two components: the endpoint agent that runs on your Windows devices, and the cloud platform that processes telemetry, runs detection, and delivers alerts. Both are designed with SME constraints in mind — minimal footprint, no complex infrastructure, and no requirement for an on-premises server.
Endpoint agent
A lightweight Windows service that collects telemetry locally, applies initial filtering, and transmits structured event data to the EntriAlert platform over an encrypted channel.
Detection engine
A cloud-hosted rule engine that processes incoming telemetry against the current rule set. Runs continuously and raises detection events when rules match.
Alert delivery
Detected events are enriched with context, assigned a severity, and formatted into plain-language alerts. Delivered to designated recipients immediately on detection.
Rule management
Detection rules are maintained and updated by the Cyber Sip team. Updates are pushed to the platform automatically — no agent update required to receive new detections.
System Requirements
What you need to run Entry Alert
EntriAlert is designed to run on standard business hardware without specialist infrastructure. The requirements below reflect the current Beta.
Supported operating systems
- Windows 10 (version 1903 or later)
- Windows 11 (all versions)
- Windows Server 2019 / 2022 — roadmap
Hardware
- Any x64 processor
- Minimum 2 GB RAM available
- 50 MB disk space for the agent
Network
- Outbound HTTPS (port 443) to EntriAlert platform endpoints
- No inbound firewall rules required
- Proxy support — roadmap
Permissions
- Local administrator rights required for initial installation
- Agent runs as a least-privilege service account post-install
- No domain admin or Active Directory rights required
FAQ
Common questions
See it in action
Request a demo and we will walk you through a live deployment on your environment.
View Demo