Sleeper Mode
Sleeper mode lets you pre-deploy sensors that sit dormant, consuming minimal resources while collecting basic system information. When an incident starts, activation is instant, and full EDR visibility is available in the exact place it's needed without a deployment scramble.
Pre-deploy
Install sensors in sleeper mode across a client fleet or your own environment. IR firms on retainer do this at onboarding, so the deployment step of a future engagement is already done.
Activate
When something happens, wake the sleepers on the affected endpoints or cluster. Full process monitoring and forensic capability come online immediately, scoped to where the incident is instead of everywhere at once.
Contain
Activate neighboring sleepers to watch for lateral movement and isolate compromised machines while investigation continues.
Investigate
Run memory and disk forensics on activated sensors to establish root cause, then return the fleet to sleeper mode when the engagement closes.
Deploy your first sensor on the free community tier, or walk through it with a solutions engineer.
Start freeBook a demo