AI EndSight

Endpoints

No agents yet. Start the AI EndSight agent on a Windows host pointed at this server.

Live telemetry

Detections

Detections open only

No detections yet. Try the test playbook in the README.

Response actions

Kill, quarantine and isolate actions appear here with their results.

Alerts

contains

Group by

Group by

Incidents

Endpoint risk

top incident + 15% of others, 24 h half-life

Open incidents by risk

ATT&CK tactics in open incidents

Risk	Incident	Endpoint	Status	Detections	Kill chain	Storylines	Unmitigated	Last activity	Assigned

Detection validation

IdentitySight

Assets

Endpoints

Needs attention

	Endpoint	State	Users	Policy and group	Address	Agent	Health	Last seen	Tags

Policies

what agents collect, how they respond, what they ignore

Endpoint groups

an endpoint gets the policy of its highest-priority (lowest number) group, else Default

Administration

Console users

accounts and roles

Every change made through the console or API is recorded (who, from where, what, result), plus sign-ins, denied attempts, agent enrollments and command results. Secrets are masked.

Threat intelligence

Fleet prevalenceexecutables and drivers seen across endpoints

Binary	SHA-256	Hosts	Runs	First seen	Signature

Rules

Detection rules

what raises alerts

On	Rule	Source	Level	Log source	ATT&CK	Mode	Hits 24h	Status

Suppression rules

exemptions: pushed to every agent and enforced on the endpoint (no automatic kill or quarantine, offline too); matching alerts never reach the alert queue

On	Suppression rule	Conditions (all must match)	Suppressed	Hidden	State	Created

Security overview

Suspicious activities

Time / host	Severity	Rule / ATT&CK	Process	Path / target	Summary	Status	Actions

Endpoint risk

Open incidents by risk

ATT&CK tactics in open incidents

Policies

Endpoint groups

Console users

LookupIP, domain, URL or file hash

Your indicatorsanalyst IOCs, matched like feeds

Feedsrefreshed automatically; cached for offline restarts

Fleet prevalenceexecutables and drivers seen across endpoints

Feed credentials and response

Detection rules

ATT&CK coverageenabled rules per tactic

Suppression rules

Suspicious activities

Endpoint risk

Open incidents by risk

ATT&CK tactics in open incidents

Policies

Endpoint groups

Console users

LookupIP, domain, URL or file hash

Your indicatorsanalyst IOCs, matched like feeds

Feedsrefreshed automatically; cached for offline restarts

Fleet prevalenceexecutables and drivers seen across endpoints

Feed credentials and response

Detection rules

ATT&CK coverageenabled rules per tactic

Suppression rules

Suspicious activities

AI EndSight Control Center

Two-step verification

Reset your password

Change password