RSA NetWitness Endpoint, offered through ProtectedIT, is an endpoint detection and response (EDR) solution designed to identify threats that traditional antivirus and host intrusion detection systems miss. The solution uses continuous behavioral monitoring across servers, desktops, laptops, and virtual machines to establish baselines of normal endpoint activity and detect deviations. A lightweight agent collects full endpoint inventories and profiles with minimal impact on end-user performance. Detection is driven by machine learning and UEBA capabilities, which score and prioritize incidents based on potential threat level. The system automatically collects and analyzes processes and executables, records contextual data around unknown items, and communicates with the RSA NetWitness Endpoint server for further analysis. RSA NetWitness Endpoint integrates with the broader RSA NetWitness Platform, enabling correlation of threat data across logs, packets, and endpoint telemetry. This allows security teams to contain affected endpoints and eradicate threats across the entire organization. Key operational capabilities include: - Continuous monitoring of all processes, executables, events, and behaviors on endpoints - Rapid data collection with a lightweight agent causing no discernible productivity impact - Scalability from hundreds to hundreds of thousands of endpoints - Root cause analysis to reduce attacker dwell time - Detection of known, unknown, targeted, and non-malware threats The product protects over 1 million endpoints across 200+ customers worldwide.