Question 1

What is ThreatLocker Detect?

Accepted Answer

ThreatLocker® Detect is a policy-based Endpoint Detection and Response (EDR) solution. This EDR addition to the ThreatLocker Platform watches for unusual events or Indicators of Compromise (IoCs). ThreatLocker Detect can send alerts and take automated actions if an anomaly is detected.

Question 2

Is a separate antivirus necessary to run ThreatLocker Detect?

Accepted Answer

No, you don't need a separate antivirus - but ThreatLocker Detect plays very nicely with Windows Defender.

Question 3

Does ThreatLocker have its own antivirus?

Accepted Answer

While we do not have a separate antivirus, we do manage a large list of Indicators of Compromise (IoCs) as well as a list of known bad files we can discover during the baseline. The detections in this baseline can be used to deny any known bad files that already existed on the machine at the time of deployment.

Question 4

Do we need the other ThreatLocker modules for Detect to work?

Accepted Answer

While not all modules are technically required, ThreatLocker Detect uses telemetry from our existing Zero Trust controls to identify indicators of compromise and other suspicious activity. It also enables swift responses to detections by allowing you to enable or disable any control policies. When used in conjunction with the other modules, it delivers a more comprehensive solution and enhanced protection.

Question 5

Can we create Detect exceptions where we can say we do not want to be notified about certain kinds of Detect alerts without having to create an exception in the response settings text?

Accepted Answer

Yes, ThreatLocker detection exceptions can be configured with granularity, even on a per-machine basis. This allows you to filter out false positives by tailoring exceptions to specific details included in any alert.

Question 6

How is the ThreatLocker Detect IOC list better than CrowdStrike's and other leading IOC lists?

Accepted Answer

Our approach minimizes reliance on IOC, as such its role in the cybersecurity protocols is very different between the two companies. With Zero Trust controls in place, malicious activities are typically blocked proactively—long before detection would even be necessary.

Question 7

Do we need to have the MDR Service to use ThreatLocker Detect?

Accepted Answer

No. ThreatLocker Detect is fully functional without the MDR service. The MDR service provides 24/7 monitoring and response to Detect alerts.

Question 8

Do we only have access to the policies/definitions provided by ThreatLocker with ThreatLocker Detect?

Accepted Answer

No. ThreatLocker Community provides a repository of policies created by ThreatLocker but also gives you the ability to subscribe to customer libraries and access their policies if desired. To that point, you can also create and publish your own policies to your own library.

Question 9

Can we connect to an SIEM with ThreatLocker Detect?

Accepted Answer

Yes, this is possible via our API. See our knowledge base article for more information: https://threatlocker.kb.help/api-users/

Stop threats
before they start

Check out Zero Trust in action

HEAR FROM OUR CUSTOMERS

Speediness can’t outpace prevention

Learn more about what Zero Trust protection looks like.

Stop threats before they start

Check out Zero Trust in action

HEAR FROM OUR CUSTOMERS

Speediness can’t outpace prevention

Learn more about what Zero Trust protection looks like.

Stop threats
before they start