DE · EN

Call us

build 6ddc7a35 | content blog-content@417154f · 338 posts | profiles 32 · corpus 315 | ● 0 skipped | built 2026-10-21 12:35 UTC format run

$ soultec get solution/endpoint-security -o yaml$ soultec get solution/endpoint-security -o json$ soultec get solution/endpoint-security -o toml$ soultec get solution/endpoint-security -o xml$ python3 endpoint-security.pyPS> ./endpoint-security.ps1$ go run endpoint-security.go$ node endpoint-security.js

apiVersion: soultec.ch/v1kind: Solutionmetadata: name: endpoint-security locale: en labels: capability/endpoint-security: 2.73 capability/security: 1.91 vendor/crowdstrike: 4.38 vendor/microsoft: 2.61 vendor/halcyon: 5.07 annotations: source: src/content/solutions/en/endpoint-security.md route: /en/solutions/endpoint-security/ schema: /nerd/schema/solutions.json markdown: /en/solutions/endpoint-security.mdspec: title: Endpoint Security tags: [endpoint-security, security] vendors: [crowdstrike, microsoft, halcyon] summary: >- Devices left the company network faster than they were secured. Two EDR products cover this, plus one layer against ransomware alone. photoNeed: A security console on screen with real alerts in it, being triaged stub: false draft: false kind: vendor addon: false status: current sections: - heading:

Attacks through permitted tools

body: | Devices left the company network, and not everywhere was securing them thought through first. Most attacks now use techniques like lateral movement and island hopping: they do damage through tools that are already permitted on the machine. A scanner comparing files against a list sees none of it. - heading:

What these products do differently

body: | CrowdStrike Falcon and Microsoft Defender read system events to learn what normal activity looks like in an estate. What stands out is then a sequence that does not fit, such as an Office document starting PowerShell. Much of the value is in the recording. After an incident you can use it to reconstruct what happened. Halcyon stands beside them and fights ransomware alone. It adds the layer that intercepts encryption and takes the leverage out of extortion. - heading:

Licensing and responsibility

body: | Which of the two EDR products fits is usually settled by existing licensing. EDR needs a team assigned to it.status: corpus: 315 services: - {ref: services/modern-workplace, score: 0.75} - {ref: services/security, score: 0.67} - {ref: services/managed-security, score: 0.48} - {ref: services/academy, score: 0.33} experts: - {ref: experts/oliver-erismann, score: 0.20} neighbours: - {ref: solutions/endpoint-security/crowdstrike-falcon, score: 1.00} - {ref: solutions/endpoint-security/microsoft-defender-atp, score: 1.00} - {ref: solutions/endpoint-security/halcyon-anti-ransomware, score: 0.78} search: /en/search.json

{ "apiVersion": "soultec.ch/v1", "kind": "Solution", "metadata": { "name": "endpoint-security", "locale": "en", "labels": { "capability/endpoint-security": 2.73, "capability/security": 1.91, "vendor/crowdstrike": 4.38, "vendor/microsoft": 2.61, "vendor/halcyon": 5.07 }, "annotations": { "source": "src/content/solutions/en/endpoint-security.md", "route": "/en/solutions/endpoint-security/", "schema": "/nerd/schema/solutions.json", "markdown": "/en/solutions/endpoint-security.md" } }, "spec": { "title": "Endpoint Security", "tags": [ "endpoint-security", "security" ], "vendors": [ "crowdstrike", "microsoft", "halcyon" ], "summary": "Devices left the company network faster than they were secured. Two EDR products cover this, plus one layer against ransomware alone.", "photoNeed": "A security console on screen with real alerts in it, being triaged", "stub": false, "draft": false, "kind": "vendor", "addon": false, "status": "current", "sections": [ { "heading": "

Attacks through permitted tools

", "body": "Devices left the company network, and not everywhere was securing them thought through\nfirst. Most attacks now use techniques like lateral movement and island hopping: they do\ndamage through tools that are already permitted on the machine. A scanner comparing files\nagainst a list sees none of it." }, { "heading": "

What these products do differently

", "body": "CrowdStrike Falcon and Microsoft Defender read system events to learn what normal activity\nlooks like in an estate. What stands out is then a sequence that does not fit, such as an\nOffice document starting PowerShell.\n\nMuch of the value is in the recording. After an incident you can use it to reconstruct\nwhat happened.\n\nHalcyon stands beside them and fights ransomware alone. It adds the layer that intercepts\nencryption and takes the leverage out of extortion." }, { "heading": "

Licensing and responsibility

", "body": "Which of the two EDR products fits is usually settled by existing licensing. EDR needs a\nteam assigned to it." } ] }, "status": { "corpus": 315, "services": [ { "ref": "services/modern-workplace", "score": "0.75" }, { "ref": "services/security", "score": "0.67" }, { "ref": "services/managed-security", "score": "0.48" }, { "ref": "services/academy", "score": "0.33" } ], "experts": [ { "ref": "experts/oliver-erismann", "score": "0.20" } ], "neighbours": [ { "ref": "solutions/endpoint-security/crowdstrike-falcon", "score": "1.00" }, { "ref": "solutions/endpoint-security/microsoft-defender-atp", "score": "1.00" }, { "ref": "solutions/endpoint-security/halcyon-anti-ransomware", "score": "0.78" } ], "search": "/en/search.json" }}

apiVersion = "soultec.ch/v1"kind = "Solution"[metadata]name = "endpoint-security"locale = "en"[metadata.labels]"capability/endpoint-security" = 2.73"capability/security" = 1.91"vendor/crowdstrike" = 4.38"vendor/microsoft" = 2.61"vendor/halcyon" = 5.07[metadata.annotations]source = "src/content/solutions/en/endpoint-security.md"route = "/en/solutions/endpoint-security/"schema = "/nerd/schema/solutions.json"markdown = "/en/solutions/endpoint-security.md"[spec]title = "Endpoint Security"tags = ["endpoint-security", "security"]vendors = ["crowdstrike", "microsoft", "halcyon"]summary = "Devices left the company network faster than they were secured. Two EDR products cover this, plus one layer against ransomware alone."photoNeed = "A security console on screen with real alerts in it, being triaged"stub = falsedraft = falsekind = "vendor"addon = falsestatus = "current"[[spec.sections]]heading = "

Attacks through permitted tools

"body = '''Devices left the company network, and not everywhere was securing them thought throughfirst. Most attacks now use techniques like lateral movement and island hopping: they dodamage through tools that are already permitted on the machine. A scanner comparing filesagainst a list sees none of it.'''[[spec.sections]]heading = "

What these products do differently

"body = '''CrowdStrike Falcon and Microsoft Defender read system events to learn what normal activitylooks like in an estate. What stands out is then a sequence that does not fit, such as anOffice document starting PowerShell.Much of the value is in the recording. After an incident you can use it to reconstructwhat happened.Halcyon stands beside them and fights ransomware alone. It adds the layer that interceptsencryption and takes the leverage out of extortion.'''[[spec.sections]]heading = "

Licensing and responsibility

"body = '''Which of the two EDR products fits is usually settled by existing licensing. EDR needs ateam assigned to it.'''[status]corpus = 315search = "/en/search.json"[[status.services]]ref = "services/modern-workplace"score = "0.75"[[status.services]]ref = "services/security"score = "0.67"[[status.services]]ref = "services/managed-security"score = "0.48"[[status.services]]ref = "services/academy"score = "0.33"[[status.experts]]ref = "experts/oliver-erismann"score = "0.20"[[status.neighbours]]ref = "solutions/endpoint-security/crowdstrike-falcon"score = "1.00"[[status.neighbours]]ref = "solutions/endpoint-security/microsoft-defender-atp"score = "1.00"[[status.neighbours]]ref = "solutions/endpoint-security/halcyon-anti-ransomware"score = "0.78"

<?xml version="1.0" encoding="UTF-8"?><manifest kind="Solution"> <apiVersion>soultec.ch/v1</apiVersion> <metadata> <name>endpoint-security</name> <locale>en</locale> <labels> <entry key="capability/endpoint-security">2.73</entry> <entry key="capability/security">1.91</entry> <entry key="vendor/crowdstrike">4.38</entry> <entry key="vendor/microsoft">2.61</entry> <entry key="vendor/halcyon">5.07</entry> </labels> <annotations> <source>src/content/solutions/en/endpoint-security.md</source> <route>/en/solutions/endpoint-security/</route> <schema>/nerd/schema/solutions.json</schema> <markdown>/en/solutions/endpoint-security.md</markdown> </annotations> </metadata> <spec> <title>Endpoint Security</title> <tags> <item>endpoint-security</item> <item>security</item> </tags> <vendors> <item>crowdstrike</item> <item>microsoft</item> <item>halcyon</item> </vendors> <summary>Devices left the company network faster than they were secured. Two EDR products cover this, plus one layer against ransomware alone.</summary> <photoNeed>A security console on screen with real alerts in it, being triaged</photoNeed> <stub>false</stub> <draft>false</draft> <kind>vendor</kind> <addon>false</addon> <status>current</status> <sections> <section> <heading>

Attacks through permitted tools

</heading> <body>Devices left the company network, and not everywhere was securing them thought throughfirst. Most attacks now use techniques like lateral movement and island hopping: they dodamage through tools that are already permitted on the machine. A scanner comparing filesagainst a list sees none of it. </body> </section> <section> <heading>

What these products do differently

</heading> <body>CrowdStrike Falcon and Microsoft Defender read system events to learn what normal activitylooks like in an estate. What stands out is then a sequence that does not fit, such as anOffice document starting PowerShell.Much of the value is in the recording. After an incident you can use it to reconstructwhat happened.Halcyon stands beside them and fights ransomware alone. It adds the layer that interceptsencryption and takes the leverage out of extortion. </body> </section> <section> <heading>

Licensing and responsibility

</heading> <body>Which of the two EDR products fits is usually settled by existing licensing. EDR needs ateam assigned to it. </body> </section> </sections> </spec> <status> <corpus>315</corpus> <services> <item> <ref>services/modern-workplace</ref> <score>0.75</score> </item> <item> <ref>services/security</ref> <score>0.67</score> </item> <item> <ref>services/managed-security</ref> <score>0.48</score> </item> <item> <ref>services/academy</ref> <score>0.33</score> </item> </services> <experts> <item> <ref>experts/oliver-erismann</ref> <score>0.20</score> </item> </experts> <neighbours> <item> <ref>solutions/endpoint-security/crowdstrike-falcon</ref> <score>1.00</score> </item> <item> <ref>solutions/endpoint-security/microsoft-defender-atp</ref> <score>1.00</score> </item> <item> <ref>solutions/endpoint-security/halcyon-anti-ransomware</ref> <score>0.78</score> </item> </neighbours> <search>/en/search.json</search> </status></manifest>

# Code generated by the soultec.ch build. DO NOT EDIT.import jsonPAGE = { "apiVersion": "soultec.ch/v1", "kind": "Solution", "metadata": { "name": "endpoint-security", "locale": "en", "labels": { "capability/endpoint-security": 2.73, "capability/security": 1.91, "vendor/crowdstrike": 4.38, "vendor/microsoft": 2.61, "vendor/halcyon": 5.07, }, "annotations": { "source": "src/content/solutions/en/endpoint-security.md", "route": "/en/solutions/endpoint-security/", "schema": "/nerd/schema/solutions.json", "markdown": "/en/solutions/endpoint-security.md", }, }, "spec": { "title": "Endpoint Security", "tags": ["endpoint-security", "security"], "vendors": ["crowdstrike", "microsoft", "halcyon"], "summary": "Devices left the company network faster than they were secured. Two EDR products cover this, plus one layer against ransomware alone.", "photoNeed": "A security console on screen with real alerts in it, being triaged", "stub": False, "draft": False, "kind": "vendor", "addon": False, "status": "current", "sections": [ { "heading": "

Attacks through permitted tools

", "body": ( "Devices left the company network, and not everywhere was securing them thought through\n" "first. Most attacks now use techniques like lateral movement and island hopping: they do\n" "damage through tools that are already permitted on the machine. A scanner comparing files\n" "against a list sees none of it." ), }, { "heading": "

What these products do differently

", "body": ( "CrowdStrike Falcon and Microsoft Defender read system events to learn what normal activity\n" "looks like in an estate. What stands out is then a sequence that does not fit, such as an\n" "Office document starting PowerShell.\n" "\n" "Much of the value is in the recording. After an incident you can use it to reconstruct\n" "what happened.\n" "\n" "Halcyon stands beside them and fights ransomware alone. It adds the layer that intercepts\n" "encryption and takes the leverage out of extortion." ), }, { "heading": "

Licensing and responsibility

", "body": ( "Which of the two EDR products fits is usually settled by existing licensing. EDR needs a\n" "team assigned to it." ), }, ], }, "status": { "corpus": 315, "services": [ { "ref": "services/modern-workplace", "score": "0.75", }, { "ref": "services/security", "score": "0.67", }, { "ref": "services/managed-security", "score": "0.48", }, { "ref": "services/academy", "score": "0.33", }, ], "experts": [ { "ref": "experts/oliver-erismann", "score": "0.20", }, ], "neighbours": [ { "ref": "solutions/endpoint-security/crowdstrike-falcon", "score": "1.00", }, { "ref": "solutions/endpoint-security/microsoft-defender-atp", "score": "1.00", }, { "ref": "solutions/endpoint-security/halcyon-anti-ransomware", "score": "0.78", }, ], "search": "/en/search.json", },}if __name__ == "__main__": print(json.dumps(PAGE, indent=2, ensure_ascii=False))

# Code generated by the soultec.ch build. DO NOT EDIT.$Page = [ordered]@{ apiVersion = 'soultec.ch/v1' kind = 'Solution' metadata = [ordered]@{ name = 'endpoint-security' locale = 'en' labels = [ordered]@{ 'capability/endpoint-security' = 2.73 'capability/security' = 1.91 'vendor/crowdstrike' = 4.38 'vendor/microsoft' = 2.61 'vendor/halcyon' = 5.07 } annotations = [ordered]@{ source = 'src/content/solutions/en/endpoint-security.md' route = '/en/solutions/endpoint-security/' schema = '/nerd/schema/solutions.json' markdown = '/en/solutions/endpoint-security.md' } } spec = [ordered]@{ title = 'Endpoint Security' tags = @('endpoint-security', 'security') vendors = @('crowdstrike', 'microsoft', 'halcyon') summary = 'Devices left the company network faster than they were secured. Two EDR products cover this, plus one layer against ransomware alone.' photoNeed = 'A security console on screen with real alerts in it, being triaged' stub = $false draft = $false kind = 'vendor' addon = $false status = 'current' sections = @( [ordered]@{ heading = '

Attacks through permitted tools

' body = @'Devices left the company network, and not everywhere was securing them thought throughfirst. Most attacks now use techniques like lateral movement and island hopping: they dodamage through tools that are already permitted on the machine. A scanner comparing filesagainst a list sees none of it.'@ } [ordered]@{ heading = '

What these products do differently

' body = @'CrowdStrike Falcon and Microsoft Defender read system events to learn what normal activitylooks like in an estate. What stands out is then a sequence that does not fit, such as anOffice document starting PowerShell.Much of the value is in the recording. After an incident you can use it to reconstructwhat happened.Halcyon stands beside them and fights ransomware alone. It adds the layer that interceptsencryption and takes the leverage out of extortion.'@ } [ordered]@{ heading = '

Licensing and responsibility

' body = @'Which of the two EDR products fits is usually settled by existing licensing. EDR needs ateam assigned to it.'@ } ) } status = [ordered]@{ corpus = 315 services = @( [ordered]@{ ref = 'services/modern-workplace' score = '0.75' } [ordered]@{ ref = 'services/security' score = '0.67' } [ordered]@{ ref = 'services/managed-security' score = '0.48' } [ordered]@{ ref = 'services/academy' score = '0.33' } ) experts = @( [ordered]@{ ref = 'experts/oliver-erismann' score = '0.20' } ) neighbours = @( [ordered]@{ ref = 'solutions/endpoint-security/crowdstrike-falcon' score = '1.00' } [ordered]@{ ref = 'solutions/endpoint-security/microsoft-defender-atp' score = '1.00' } [ordered]@{ ref = 'solutions/endpoint-security/halcyon-anti-ransomware' score = '0.78' } ) search = '/en/search.json' }}$Page | ConvertTo-Json -Depth 32

// Code generated by the soultec.ch build. DO NOT EDIT.package mainimport ( "encoding/json" "os")var page = map[string]any{ "apiVersion": "soultec.ch/v1", "kind": "Solution", "metadata": map[string]any{ "name": "endpoint-security", "locale": "en", "labels": map[string]any{ "capability/endpoint-security": 2.73, "capability/security": 1.91, "vendor/crowdstrike": 4.38, "vendor/microsoft": 2.61, "vendor/halcyon": 5.07, }, "annotations": map[string]any{ "source": "src/content/solutions/en/endpoint-security.md", "route": "/en/solutions/endpoint-security/", "schema": "/nerd/schema/solutions.json", "markdown": "/en/solutions/endpoint-security.md", }, }, "spec": map[string]any{ "title": "Endpoint Security", "tags": []any{"endpoint-security", "security"}, "vendors": []any{"crowdstrike", "microsoft", "halcyon"}, "summary": "Devices left the company network faster than they were secured. Two EDR products cover this, plus one layer against ransomware alone.", "photoNeed": "A security console on screen with real alerts in it, being triaged", "stub": false, "draft": false, "kind": "vendor", "addon": false, "status": "current", "sections": []any{ map[string]any{ "heading": "

Attacks through permitted tools

", "body": "Devices left the company network, and not everywhere was securing them thought through\n" + "first. Most attacks now use techniques like lateral movement and island hopping: they do\n" + "damage through tools that are already permitted on the machine. A scanner comparing files\n" + "against a list sees none of it.", }, map[string]any{ "heading": "

What these products do differently

", "body": "CrowdStrike Falcon and Microsoft Defender read system events to learn what normal activity\n" + "looks like in an estate. What stands out is then a sequence that does not fit, such as an\n" + "Office document starting PowerShell.\n" + "\n" + "Much of the value is in the recording. After an incident you can use it to reconstruct\n" + "what happened.\n" + "\n" + "Halcyon stands beside them and fights ransomware alone. It adds the layer that intercepts\n" + "encryption and takes the leverage out of extortion.", }, map[string]any{ "heading": "

Licensing and responsibility

", "body": "Which of the two EDR products fits is usually settled by existing licensing. EDR needs a\n" + "team assigned to it.", }, }, }, "status": map[string]any{ "corpus": 315, "services": []any{ map[string]any{ "ref": "services/modern-workplace", "score": "0.75", }, map[string]any{ "ref": "services/security", "score": "0.67", }, map[string]any{ "ref": "services/managed-security", "score": "0.48", }, map[string]any{ "ref": "services/academy", "score": "0.33", }, }, "experts": []any{ map[string]any{ "ref": "experts/oliver-erismann", "score": "0.20", }, }, "neighbours": []any{ map[string]any{ "ref": "solutions/endpoint-security/crowdstrike-falcon", "score": "1.00", }, map[string]any{ "ref": "solutions/endpoint-security/microsoft-defender-atp", "score": "1.00", }, map[string]any{ "ref": "solutions/endpoint-security/halcyon-anti-ransomware", "score": "0.78", }, }, "search": "/en/search.json", },}func main() { enc := json.NewEncoder(os.Stdout) enc.SetEscapeHTML(false) enc.SetIndent("", " ") if err := enc.Encode(page); err != nil { os.Exit(1) }}

// Code generated by the soultec.ch build. DO NOT EDIT.const page = { apiVersion: "soultec.ch/v1", kind: "Solution", metadata: { name: "endpoint-security", locale: "en", labels: { "capability/endpoint-security": 2.73, "capability/security": 1.91, "vendor/crowdstrike": 4.38, "vendor/microsoft": 2.61, "vendor/halcyon": 5.07, }, annotations: { source: "src/content/solutions/en/endpoint-security.md", route: "/en/solutions/endpoint-security/", schema: "/nerd/schema/solutions.json", markdown: "/en/solutions/endpoint-security.md", }, }, spec: { title: "Endpoint Security", tags: ["endpoint-security", "security"], vendors: ["crowdstrike", "microsoft", "halcyon"], summary: "Devices left the company network faster than they were secured. Two EDR products cover this, plus one layer against ransomware alone.", photoNeed: "A security console on screen with real alerts in it, being triaged", stub: false, draft: false, kind: "vendor", addon: false, status: "current", sections: [ { heading: "

Attacks through permitted tools

", body: "Devices left the company network, and not everywhere was securing them thought through\n" + "first. Most attacks now use techniques like lateral movement and island hopping: they do\n" + "damage through tools that are already permitted on the machine. A scanner comparing files\n" + "against a list sees none of it.", }, { heading: "

What these products do differently

", body: "CrowdStrike Falcon and Microsoft Defender read system events to learn what normal activity\n" + "looks like in an estate. What stands out is then a sequence that does not fit, such as an\n" + "Office document starting PowerShell.\n" + "\n" + "Much of the value is in the recording. After an incident you can use it to reconstruct\n" + "what happened.\n" + "\n" + "Halcyon stands beside them and fights ransomware alone. It adds the layer that intercepts\n" + "encryption and takes the leverage out of extortion.", }, { heading: "

Licensing and responsibility

", body: "Which of the two EDR products fits is usually settled by existing licensing. EDR needs a\n" + "team assigned to it.", }, ], }, status: { corpus: 315, services: [ { ref: "services/modern-workplace", score: "0.75", }, { ref: "services/security", score: "0.67", }, { ref: "services/managed-security", score: "0.48", }, { ref: "services/academy", score: "0.33", }, ], experts: [ { ref: "experts/oliver-erismann", score: "0.20", }, ], neighbours: [ { ref: "solutions/endpoint-security/crowdstrike-falcon", score: "1.00", }, { ref: "solutions/endpoint-security/microsoft-defender-atp", score: "1.00", }, { ref: "solutions/endpoint-security/halcyon-anti-ransomware", score: "0.78", }, ], search: "/en/search.json", },};console.log(JSON.stringify(page, null, 2));

# 65 lines · YAML · validated at build# 96 lines · JSON · validated at build# 97 lines · TOML · validated at build# 114 lines · XML · validated at build# 113 lines · Python · read back at build, equals the JSON record# 110 lines · PowerShell · read back at build, equals the JSON record# 119 lines · Go · read back at build, equals the JSON record# 104 lines · JavaScript · read back at build, equals the JSON record · served at /en/solutions/endpoint-security.md

Solution · CrowdStrike

Endpoint Security

Devices left the company network faster than they were secured. Two EDR products cover this, plus one layer against ransomware alone.

Topics Endpoint Security 2.73 Security 1.91

Vendors CrowdStrike 4.38 Microsoft 2.61 Halcyon 5.07

04Services

02Capabilities

315Corpus

photograph wantedA security console on screen with real alerts in it, being triaged

Attacks through permitted tools

Devices left the company network, and not everywhere was securing them thought through first. Most attacks now use techniques like lateral movement and island hopping: they do damage through tools that are already permitted on the machine. A scanner comparing files against a list sees none of it.

What these products do differently

CrowdStrike Falcon and Microsoft Defender read system events to learn what normal activity looks like in an estate. What stands out is then a sequence that does not fit, such as an Office document starting PowerShell.

Much of the value is in the recording. After an incident you can use it to reconstruct what happened.

Halcyon stands beside them and fights ransomware alone. It adds the layer that intercepts encryption and takes the leverage out of extortion.

Licensing and responsibility

Which of the two EDR products fits is usually settled by existing licensing. EDR needs a team assigned to it.

Endpoint SecuritySecurity

Who works with it

Oliver Erismann

Senior System Engineer

Endpoint Security

0.20

Do you work with this? Take a look at our open roles.

Attacks through permitted tools

What these products do differently

Licensing and responsibility

Attacks through permitted tools

What these products do differently

Licensing and responsibility

Attacks through permitted tools

What these products do differently

Licensing and responsibility

Attacks through permitted tools

What these products do differently

Licensing and responsibility

Attacks through permitted tools

What these products do differently

Licensing and responsibility

Attacks through permitted tools

What these products do differently

Licensing and responsibility

Attacks through permitted tools

What these products do differently

Licensing and responsibility

Attacks through permitted tools

What these products do differently

Licensing and responsibility

Endpoint Security

Attacks through permitted tools

What these products do differently

Licensing and responsibility

Products 3

CrowdStrike Falcon

Halcyon Anti-Ransomware

Microsoft Defender

Who works with it

Oliver Erismann