// Platform //

One console for detection, response & XDR

Process & network telemetry

Process DNA with path, command line, SHA-256 and Authenticode verdict, plus the connection table, DNS cache and per-process bytes from ETW.

Learn more



Malware & memory

Hash matching against a local list, path heuristics, module walks and private RWX memory checks, on demand and on a schedule.



Persistence & scripts

Run keys, scheduled tasks, WMI subscriptions, services, vulnerable drivers and PowerShell script blocks.



XDR connectors

Optional Entra and Microsoft 365 signals, TAXII 2.1 threat intel, SIEM export and SOAR webhooks.



// Response //

Containment that asks first



Terminate a process tree

Stop a process or its whole tree through the one-shot elevated helper, after the termination grant and a Windows UAC prompt.



Block an IP or isolate the host

Named Windows Firewall rules you can see in wf.msc. Host isolation is one outbound block rule that is just as easy to release.



Quarantine a suspicious file

Move a selected file into the RECONIFIED quarantine folder with its original name kept, gated by the quarantine grant.



Allowlisted live response

Built-in checks only: ps, netstat, filehash, reg query, ls, whoami and env. Any other command text is refused.

// Why RECONIFIED //

User-mode visibility, operator-controlled response

No driver, no service

Sensors run in user mode through documented Win32, ETW, firewall and service APIs. Nothing is loaded into the kernel and nothing is installed as a Windows service.

Continuous local telemetry

Processes, network, persistence and host resources are scanned every few seconds and stored in SQLite on the PC. Nothing is uploaded unless you configure a destination.

Request a demo