ArmorPoint XDR

ArmorPoint XDR is a self-operated extended detection and response platform that consolidates endpoint, identity, cloud, SaaS, network, and log data into a single console for internal security teams to run their own SOC. The platform ingests logs from any source that can forward them and uses an AI triage engine to classify alerts as benign, suspicious, or malicious, providing a confidence score and rationale. It correlates related signals across sources into a single incident rather than presenting separate alerts, giving analysts one screen with user, device, and timeline context to reduce manual correlation across multiple consoles. Analysts can respond directly from the platform, including isolating hosts, killing processes, quarantining endpoints, disabling or revoking identity accounts, and blocking indicators or IP addresses. Detections are mapped to the MITRE ATT&CK framework, and the platform generates one-click incident reports for audit and compliance purposes. This is the same underlying platform ArmorPoint's managed SOC uses for its MDR and MXDR service tiers, but with XDR the customer's own team operates the platform rather than ArmorPoint. ArmorPoint provides and maintains the platform, handles onboarding and enablement, and offers support, while the customer's team is responsible for 24/7 monitoring, investigation, response, and detection tuning. The platform supports Windows, macOS, and Linux endpoints, retains alert and incident data for 365 days, retains logs for 30 days online plus 365 days archived, and stores data in US-owned data centers.