THE FIELD GUIDE / SECURITY & RESPONSE
Scanning & incident review
ClamAV, YARA, coverage receipts and the incident timeline.
Choose scope and cadence
Configure on-demand, interval-scheduled and event-triggered scans. ClamAV and authenticated offline YARA rules complement process monitoring. Reviewed scanner and signature maintenance keeps engine prerequisites and update policy explicit.
Pivot across stored evidence
Related evidence links scanner findings with retained process, startup/custom-file, package and authenticated vendor records. It distinguishes matching path/hash, the same hash elsewhere and changed bytes at the same path, while keeping observed versus expected hashes and coverage limits separate. A shared path or hash is not proof of causation or malicious intent.
Read the receipt
Each scan retains its engine context, signature freshness, scope, counts, timestamps and coverage gaps. Limits, inaccessible paths, signature changes and traversal races remain visible. An incomplete scan can still contain a valid detection; an empty detection list is not a clean-host verdict.
Review fleet scanner coverage
The administrator Security coverage workspace keeps independent ClamAV/YARA receipts, signature/rule freshness, latest attempts and incident counts visible across managed servers. Missing receipts, failed attempts and stale observations remain gaps, while disabled servers keep clearly marked history. Reads use stored evidence rather than contacting targets.
Review incidents
Acknowledge, reopen, record false positives or record manual resolution with a reason. New detections reopen an incident and supersede stale evidence-bound approvals. Timeline entries preserve detections, prior state, plan requests and administrator reviews.
Monitor CVE exploitation
Correlate applicable CVEs with endpoint evidence from publication through effective fix verification. An explicitly enabled response policy can automatically quarantine an identified malicious artifact or terminate an identified malicious process when exploitation evidence meets its threshold. Monitor-only mode keeps detection separate from response. Read the CVE exposure and containment guide.
Malware beyond a CVE
Known signature scanning and evidence-linked behavioral triage cover malware investigations even without a known CVE or signature. A configured policy can quarantine malicious artifacts and terminate verified associated processes, recording each result separately. Read the malware detection and response guide.
Connect the evidence
Search exact hashes across retained fleet detections and correlate behavioral, integrity and threat-intelligence evidence. AI can propose an evidence-linked response plan. Manual plans retain separate review; automatic actions require an explicitly enabled, scoped response policy.
Open the application reference for capability scope and technical details.
Open Open SECURITY_IMPLEMENTATION.md on GitHub ↗