Kestrel EDRSelf-hosted EDR for Windows

Catches infostealers while they work, contains the process on the device, and gives IT one incident that says what was taken and what to rotate. Your telemetry stays on your own server.

Step-by-step install

What Kestrel is

Build from source

Infostealers first

16 stealer rules (ST-01 to ST-16) watch for credential-store reads, DPAPI decryption of browser secrets, browser debugging abuse, steal-then-send and canary decoys.

Rule reference

Ransomware, credential dumping, persistence

RW, CD and PS rule families cover shadow-copy deletion, mass encryption, LSASS dumps, hive theft, Run keys, tasks, services and WMI. Plus a 70-rule SigmaHQ pack in Audit.

Rule families

Detection and containment on the device

Rules run in the agent, so they keep working offline. Suspend, kill, quarantine, block network access through WFP, or isolate the host.

Response actions

Incidents, not alert floods

Alerts are grouped by device and process tree into one incident with a priority, a plain-language storyline, the data at risk and a remediation checklist.

Using the console

Self-hosted

One Docker Compose stack per organisation (server, PostgreSQL, optional ClickHouse). Agents talk to it over mutual TLS with a pinned internal CA.

Deploy the server

Honest about user mode

Kestrel has no kernel driver. It aims to detect fast and contain fast; it does not guarantee prevention, and the docs say where the limits are.

Security model and limits