uberAgent — See Everything. Fix It Faster. Keep It Secure.

uberAgent captures every stage of the Windows boot and user logon process — from power-on through Group Policy processing, profile load, logon script execution, and application readiness. When logon times creep up, the data shows exactly which stage is responsible and on which machines, without requiring manual investigation.

uberAgent detects application hangs, crashes, and unresponsiveness events across every managed endpoint — including which specific version of which application is failing and how frequently. This makes it possible to correlate a sudden spike in helpdesk calls with a specific application update or configuration change.

Most monitoring tools measure network performance at the interface level. uberAgent captures latency, jitter, and packet loss per application and per network connection — making it immediately clear whether a slow application is caused by a network issue, and which network path is responsible.

As more business applications move to the browser, measuring performance inside the browser becomes critical. uberAgent monitors browser activity and web app response times — identifying slow SaaS applications, measuring page load performance, and tracking which browser extensions are consuming resources.

uberAgent automatically detects Citrix Virtual Delivery Agent (VDA) and Delivery Controller environments and activates Citrix-specific metrics — session ICA latency, machine registration status, licence usage, published application inventory, and Machine Catalogue health — giving a complete picture of your CVAD site from a single tool.

uberAgent tracks exactly which applications are used, how often, and by which users — across every managed device. This provides the data needed for software licence audits, right-sizing purchasing decisions, and identifying shelfware. Organisations commonly discover 15–25% licence cost savings from the usage data alone.

ESA's threat detection engine uses the MITRE ATT&CK framework to classify and detect adversary tactics and techniques in real time. It supports Sigma rules — the open standard for security detection — and Sysmon rules, with a graphical rule editor so your team can customise detection without writing XML. The uAQL query language makes rules precise and readable.

ESA traces every process launch back through its parent chain — making it possible to see not just that a suspicious process ran, but exactly what caused it to run, in what sequence, and under which user context. This is the data that separates a meaningful threat alert from noise, and makes investigations conclusive rather than speculative.

ESA monitors every DNS query made from every endpoint — per user, per application, and per process — detecting DNS-based C2 communications, tunnelling attempts, and connections to known-malicious domains. Network connections are tracked by user, application, and network target, making lateral movement and data exfiltration visible.

ESA tracks registry modifications and file system events across endpoints — detecting persistence mechanisms, malicious registry writes, and suspicious file creation or modification patterns. Hash calculation enables file integrity verification, and Authenticode signature checking flags unsigned or incorrectly signed executables before they cause harm.

ESA conducts periodic security configuration checks across endpoints — verifying that line-of-business applications, operating system settings, and security controls meet defined standards. Results are presented as a compliance rating per endpoint, with the ability to create custom checks against your own security policies and regulatory requirements.

ESA is designed to complement, not replace, existing EDR and XDR solutions. The granular data it provides — particularly on Citrix and virtual endpoints that many EDR tools cover poorly — feeds SOC workflows via Splunk, Elasticsearch, or other SIEM platforms. ESA extends detection coverage to environments that existing tools may miss entirely.