Detect. Correlate. Respond.
Prevention fails eventually. CtrlLayer's built-in threat detection engine catches what gets through: seven security analyzers, five correlation rule categories, and 48,000+ threat intelligence indicators working in real-time.
Security Master: Continuous Scoring
Every endpoint receives a continuous A-F security grade based on seven independent analyzers. Not a point-in-time snapshot. A living assessment.
System Configuration
15%Evaluates OS hardening, UAC settings, firewall state, and security policy configuration against CIS benchmarks.
Patch Compliance
20%Assesses Windows Update status, missing critical patches, patch age, and update history consistency.
Security Software
15%Verifies antivirus status, real-time protection, definition currency, and Windows Defender configuration.
Network Exposure
15%Analyzes open ports, listening services, outbound connections to suspicious destinations, and firewall rule coverage.
User Behavior
10%Evaluates elevation request patterns, failed attempt frequency, off-hours activity, and account anomalies.
Elevation Patterns
10%Assesses elevation frequency, auto-approval ratios, emergency elevation usage, and policy compliance rates.
Threat Indicators
15%Matches system artifacts against 48,000+ threat intelligence indicators: known malware hashes, C2 domains, and suspicious registry keys.
How Scoring Works
Each analyzer independently evaluates its domain and produces a normalized score. These scores are weighted and aggregated into a single A-F grade. The weighting reflects the relative security impact of each category, with patch compliance and threat indicators carrying the highest weights.
Scores update continuously as endpoint telemetry arrives. A device that was graded B in the morning can drop to D by afternoon if a critical patch is missed or a threat indicator is detected. This real-time responsiveness ensures that security teams always see the current state, not a stale assessment.
For MSPs, Security Master scores provide a universal language for communicating endpoint health to clients. "Your fleet is 82% grade A or B" is more actionable than a 40-page vulnerability report.
Blue Team: Event Correlation
Individual events are noise. Correlated events are intelligence. Blue Team connects the dots across time, endpoints, and data sources.
Brute Force Detection
HighIdentifies rapid authentication failures followed by a success, indicating credential guessing attacks against local or domain accounts.
- Multiple failed login attempts from single source
- Rapid password attempts against local admin accounts
- Successful login following failed streak
- Time correlation with other suspicious activity
Lateral Movement
CriticalDetects patterns consistent with post-exploitation lateral movement: remote execution, credential harvesting, and network reconnaissance.
- Remote process execution on managed endpoints
- LSASS memory access attempts
- Network share enumeration from unusual sources
- Credential use from new/unusual devices
Policy Bypass
CriticalIdentifies attempts to circumvent elevation policies, disable security agents, or modify security-critical system configurations.
- Attempts to modify elevation agent configuration
- Security service stop/disable events
- Registry modifications to security-critical keys
- Group policy tampering attempts
USB Exfiltration
HighDetects patterns consistent with data exfiltration via removable media: large file copies to USB, encrypted container creation, and unusual USB activity.
- Large data transfers to removable media
- Encrypted container creation on USB devices
- USB device connection followed by bulk file operations
- After-hours USB activity on sensitive systems
Privilege Escalation
CriticalIdentifies attempts to gain higher privileges than authorized through system exploitation, misconfiguration abuse, or token manipulation.
- Unauthorized service installation
- Scheduled task creation with elevated privileges
- Token impersonation/theft attempts
- Unquoted service path exploitation
48,000+ Threat Intelligence Indicators
CtrlLayer maintains a continuously updated database of known-bad indicators from multiple threat intelligence sources.
IP Addresses
Known command-and-control servers, malware distribution endpoints, botnet infrastructure, and phishing hosting providers. Every outbound connection from managed endpoints is matched against this database in real-time.
Domain Names
Malicious domains, typosquatting domains targeting common enterprise services, known phishing domains, and domains associated with malware campaigns.
File Hashes
SHA-256 hashes of known malware, ransomware, and potentially unwanted programs. Applications requesting elevation are checked against this database before approval.
Registry Indicators
Known malware persistence mechanisms, suspicious registry keys and values, and indicators of compromise commonly found in Windows registry after exploitation.
Continuous Updates
The threat intelligence database is updated regularly from curated sources. New indicators are effective across all managed endpoints immediately upon publication. There is no agent update required for new threat intelligence. The matching happens centrally against telemetry data flowing from all managed devices.
Real-Time Alerting
Detections without notifications are just logs. CtrlLayer ensures the right people know about threats when they happen.
Severity-Based Routing
Alerts are classified by severity: Critical, High, Medium, and Low. Configure notification channels and escalation paths based on severity. Critical alerts can trigger immediate notifications to on-call staff. Low severity events can be batched into daily summaries.
Context-Rich Notifications
Every alert includes full context: the affected device, the user, the triggering events, the correlation rule that fired, and recommended response actions. Responders have everything they need to act without switching to another console.
Alert Deduplication
Repeated occurrences of the same threat pattern are deduplicated to prevent alert fatigue. The initial detection generates a full alert. Subsequent occurrences update the existing alert with new instance count and timeline data.
Audit Trail Integration
Every alert, acknowledgment, and response action is recorded in the audit trail. Post-incident review can trace the complete timeline from initial detection through response and resolution.
Why Built-In Threat Detection Matters
No Additional Cost
Threat detection is included in the CtrlLayer platform. No separate SIEM license. No additional threat intelligence subscription. No integration fees. The cost of detection is zero above your existing per-endpoint price.
Correlated With Elevation
External threat detection tools cannot correlate with elevation events because they do not have access to elevation data. CtrlLayer's built-in detection sees everything: the elevation request, the process behavior during elevation, and the network activity that follows. This correlation detects threats that separate tools would miss.
Zero-Setup Deployment
Threat detection activates the moment the agent is installed. No log forwarding to configure. No SIEM rules to write. No dashboards to build. Detection is operational from day one with pre-built correlation rules and curated threat intelligence.