Security

Detections from endpoints and Microsoft 365 in one queue

The agent ships Windows event logs, macOS and Linux logs, and Microsoft 365 sign-in signals come in from the tenants you manage. Rules turn them into detections with the evidence attached, vulnerabilities are tracked per device, and remote access tools you did not put there are found and removed.

Get early access Read the guide

Security detections with severity, customer and device

Endpoint signals

Encoded PowerShell, event log clearing, new local admins and brute force patterns.

Microsoft 365 signals

Password spray, sign-ins from new countries, risky users and forwarding inbox rules.

Vulnerability management

Rated the way the operating system's vendor rates them, put in order by what can be fixed and what attackers use, and grouped by the update that fixes them.

Nothing left behind

Other remote access tools found on every device, BitLocker recovery keys collected, and customers' domains watched for breaches.

Every detection has its evidence

Open a detection to see what fired, the raw events behind it, the device or user involved and what else happened around the same time. Related detections become one incident with evidence, a customer notification and a report at the end, and VIP people and business-critical devices raise everything one step. A script that is routine for one of your tools goes on a known tools list, for one customer or for everyone.

Detections grouped into incidents with response targets
Threat intelligence feeds and MITRE ATT&CK coverage
Actions in Defender for Endpoint and SentinelOne with your own accounts
Suricata network IDS as an agent role

A security detection with its events and the affected device

Know which devices are exposed

Every finding carries the rating the operating system's vendor gives it, from Ubuntu, Debian, Red Hat or Microsoft, with CVSS beside it and a fix state. Its priority comes from what can be done: Critical only when a fix exists and attackers use it or it is likely and reachable, Mitigate when it is exploited and no fix exists, with exposure judged from the ports each program listens on. The To do list groups everything by the one update that fixes it, so installing one kernel and rebooting can clear hundreds of findings at once.

To do, grouped by the update that fixes it
Waiting on vendor kept apart from what you can fix today
One alert per update that fixes Critical findings
A section in customer reports, by priority

Vulnerability overview with findings by severity and vulnerable software

Find the remote tools you did not install

The agent looks for other remote access and RMM tools on Windows, macOS and Linux: installed, running, as a service or as a portable copy, matched by code signer first against a maintained catalogue of remote tools. Allow one everywhere, for a company or on one device with an end date and a note, or remove it from here. When you take over a customer, you can allow the outgoing provider's tool until the day the takeover ends.

Findings by tool and customer, and on the device page
Allow-lists with an end date and a note
Silent removal, with portable copies quarantined or deleted

Admin rights without handing out passwords

Users request elevation from the tray. Rules by publisher, hash or path approve the safe ones, a technician decides the rest, and timed admin sessions end on time, even across a restart. Tamper protection asks for your uninstall token before the agent comes off a device.

Run one program as admin, or a timed session
Every request and decision recorded
Alerts if the agent is stopped or removed

Admin elevation requests with the program, the device and the decision

BitLocker recovery keys, already in the vault

The agent puts every encrypted volume's recovery key into the credentials vault, however BitLocker was turned on. It checks every day and when something changes, and keeps a replaced key marked as superseded. Devices with no key held are listed on one page and on Home, and revealing a key needs the right role and is audited like any other credential.

Keys collected however encryption was switched on
Superseded keys kept beside the current one
Add a recovery password to a volume, through approval

In the knowledge base

See exactly how it works

Vulnerability priorities, fix states and To do How Tenvara rates each vulnerability the vendor's way, what the six fix states mean, how Critical, High, Routine and Mitigate are worked out from what can be done, how exposure is judged, and how the To do list groups work by the update that fixes it. Incidents and response Incidents that group related detections, response targets and metrics, pinned evidence and tickets, telling the customer, the incident report, digests and the security scorecard. Threat intelligence and MITRE coverage Known bad addresses from abuse.ch, Spamhaus and Emerging Threats on events and detections, country and network owner for every address, and the MITRE ATT&CK coverage of your rules. Syslog relays Collect syslog from firewalls, switches and printers at a site through a device with the agent, without sending syslog across the internet or opening a VPN. Vulnerability management Known vulnerabilities in the software and operating systems on every device, rated the vendor's way, prioritised by what can be done, with a deadline and the fix Tenvara can apply through patching or software deployment. The remote access and RMM tool finder Find other remote access tools and RMM agents on every device, allow the ones that belong at three levels, ignore a version, remove the rest silently, and use it while taking a customer over. BitLocker recovery keys How Tenvara collects the recovery key of every BitLocker volume into the credentials vault, however BitLocker was turned on, and where to find, add and reveal them. Admin elevation on request Let people without administrator rights ask, with a reason, to run one program as administrator or to be an administrator for a while, approved by you or by rules. Tamper protection Stop the agent being removed without the customer's uninstall token, restart it when it is killed, and get an alert when someone stops, removes or changes it. Security software and the agent What the Windows agent installs, what it runs and how its scripts are protected, so you can check it against your antivirus or EDR product, the allow rules to use if one still raises alerts, and why TLS inspection must leave the agent's connection alone. Dark web monitoring Watch your customers' domains and addresses in breach data, check vault passwords against known breaches, work exposures, and send each customer a report. Network intrusion detection Turn a Linux device with the Tenvara agent into a Suricata network sensor on a switch mirror port, and get its alerts as detections, with the sensor's health watched for you. EDR actions Isolate devices, run scans, deal with threats, manage exclusions and deploy the agent through Microsoft Defender for Endpoint and SentinelOne without leaving Tenvara. Log retention and archive Keep security events searchable for up to ten years or without limit, archive older days to cheap storage as compressed files, and bring a range back for an investigation.

Read the guide

Step by step instructions for Security, with screenshots, in the knowledge base.

Open the guide

Next area

Governance and compliance

ISO 27001, Cyber Essentials, awareness training, device hardening and AI readiness.

Keep exploring

Tenvara is coming soon.

We're inviting MSPs to the beta in small groups. Apply to join, or get launch updates by email and hear first when pricing is announced.

Get early access Get updates