🛡️

Shieldlix EDR

Real-time endpoint detection and response. Process trees, hash prevalence, and automated response actions.

Architecture

Loading diagram...

Technology Stack

Rust
Core runtime — memory-safe, zero-cost abstractions, no garbage collector
Axum
HTTP framework — type-safe routing, tower middleware, WebSocket support
Tokio
Async runtime — work-stealing scheduler, millions of concurrent I/O operations
Kafka
Event streaming — durable agent telemetry pipeline, exactly-once semantics
Agent Protocol
Lightweight gRPC agent — sub-2% CPU, event batching, offline queue
Process Graph DB
In-memory ancestry tracking with persistent snapshot storage
Next.js 16
React 19 SSR/SSG — streaming, server components, optimistic UI
React 19
UI framework — concurrent rendering, transitions, Suspense

Core Features

📡

Telemetry Ingestion

Batch endpoint events: process, file, registry, network, auth, module, driver, service, script, sensor.

🖥️

Sensor Management

List sensors, update policies, track status (online/offline/degraded/isolated) across your fleet.

🌳

Process Trees

Build process ancestry graphs with parent-child edges and associated events for root cause analysis.

🔑

Hash Prevalence

Track SHA256 hash occurrence across hosts with first/last seen timestamps.

🚨

Endpoint Alerts

Detection rules with severity, confidence, MITRE tactic/technique mapping, and recommended actions.

🛡️

Response Actions

Isolate host, release host, kill process, quarantine file — with approval workflows.

🔍

Threat Hunting

Create hunts with queries, schedules, and match tracking across your endpoint fleet.

📎

Evidence Collection

Collect triage bundles, list/download evidence, manage legal hold for forensic preservation.

MITRE ATT&CK Coverage

Initial Access
Execution
Persistence
Privilege Escalation
Defense Evasion
Credential Access
Discovery
Lateral Movement
Collection
Command and Control
Exfiltration
Impact

Response Actions

Isolate Host
Network isolation from fleet
Release Host
Restore network access
Kill Process
Terminate malicious process
Quarantine File
Move file to quarantine
Collect Evidence
Triage bundle collection
Block Hash
Block file by SHA256

How Shieldlix Compares

Feature
Shieldlix
CrowdStrike
MS Defender
Sentinel
Pricing
Free. No per-endpoint fees.
~$5.95/endpoint/month ($71.40/yr)
Included with M365 E5 ($57/user/mo)
~$2.50–$5/endpoint/month
Architecture
Rust backend + Rust agent. Memory-safe, GC-free.
Cloud-native SaaS. Proprietary agent.
M365 stack. Windows-only agent.
Azure-native. Defender for Endpoint.
Telemetry
10 event types: process, file, registry, network, auth, module, driver, service, script, sensor.
Comprehensive endpoint telemetry. Industry-leading depth.
Deep Windows telemetry. Limited Linux/macOS.
Process, file, network, registry, driver events.
Process Trees
Full ancestry graphs with parent-child edges and events.
Process lineage with command-line analysis.
Process tree visualization in advanced hunting.
Process creation events with parent tracking.
Hash Prevalence
SHA256 tracking across hosts with first/last seen.
File intelligence with prevalence scoring.
File hash indicators with cross-org prevalence.
File hash tracking via advanced hunting.
Response Actions
Isolate, release, kill, quarantine with approval workflows.
Real-time response, process kill, file quarantine, network containment.
Automated investigation and remediation.
Isolate machine, stop process, quarantine file.
Threat Hunting
Custom hunts with queries, schedules, match tracking.
Event Search, Advanced Event Search. Custom IOAs.
Advanced hunting queries in Defender portal.
Advanced hunting with KQL queries.
MITRE ATT&CK
Tactic/technique tags on all rules. Coverage API.
Full MITRE mapping with Activity Intelligence.
MITRE ATT&CK in Threat Analytics.
MITRE technique mapping in incidents.
Deployment
Lightweight Rust agent. Cross-platform. Self-hosted backend.
Cloud SaaS. Falcon agent (Windows/macOS/Linux).
M365 SaaS. Intune-managed agents.
Azure SaaS. Defender agent.
Evidence Collection
Triage bundles, evidence download, legal hold.
Remote evidence collection, Falcon Forensics.
Automated evidence collection.
Collect investigation package.

Cost Comparison

Annual EDR platform costs by fleet size. Shieldlix is always free.

Fleet Size
CrowdStrike
MS Defender
Sentinel
Shieldlix
500 endpoints
$35,700/yr
$342,000/yr (E5)
$15,000/yr
$0
2,000 endpoints
$142,800/yr
$1,368,000/yr (E5)
$60,000/yr
$0
10,000 endpoints
$714,000/yr
$6,840,000/yr (E5)
$300,000/yr
$0

Protect every endpoint

Free forever. No credit card. No usage limits.

CrowdStrike charges $5.95/endpoint/mo. Shieldlix is free.