Compliance
Compliance with LGPD, GDPR, PCI DSS, ISO 27001, NIST, among others.
Datasheet
Blockbit XDR
EXTENDED DETECTION & RESPONSE
Total Visibility
Proactive Protection
Automated Response
Blockbit XDR: The Future of Cybersecurity
Blockbit XDR (eXtended Detection & Response) is an advanced cybersecurity solution designed to provide comprehensive threat visibility, protection, and response across multiple vectors, such as endpoints, networks, emails, and cloud environments.
The platform seamlessly integrates with existing IT infrastructures, automating incident response and simplifying security management, all within a unified interface.
The solution also extends security visibility over network communications and interactions between systems, enabling the identification of suspicious behaviors, event correlations, and anomalous movements across different infrastructure layers.
Integration with Blockbit Cyber Threat Intelligence (CTI)
Native integration with Blockbit Cyber Threat Intelligence (CTI) elevates Blockbit XDR protection, providing access to up-to-date information on emerging threats, vulnerabilities, and attack tactics.
This correlation of security data with global intelligence enhances threat detection accuracy, reducing false positives and accelerating responses. In addition, it anticipates and neutralizes threats before they materialize, ensuring a more robust and adaptable defense in the dynamic cybersecurity landscape.
Advanced protection against ransomware, phishing, and "zero-day" attacks
Combining artificial intelligence, machine learning, and advanced behavioral analysis, Blockbit XDR enables the identification and blocking of sophisticated attacks in real time and automates incident response.
- 99.9%
- Threat detection rate
- +95%
- Automatically resolved incidents
- +150
- Integrations with market solutions
About Blockbit
Blockbit is a leader in cybersecurity products, protecting thousands of companies and millions of users from digital attacks and threats.
- +5M
- corporate clients
- +2MM
- protected users
Why "eXtended Detection & Response"?
Blockbit XDR delivers a more holistic and integrated security approach than traditional Endpoint Detection & Response (EDR) solutions, providing comprehensive visibility and threat defense across the entire IT infrastructure.
By correlating data from multiple sources, XDR enhances multi-vector threat detection and automates coordinated responses, reducing operational complexity and the costs associated with managing multiple security tools.
Cloud
Native integration with Azure, AWS, Google Cloud, Microsoft 365, GitHub, Docker, among others.
Automation
Real-time response with immediate remediation to block attacks.
Supported platforms:
Multi-Vector
Desktops, servers, networks, apps, emails, and cloud.
Multi-Stage
More accurate detection with event correlation.
Integration
Holistic interactions for precise blocking and response.
Automation
Orchestration and automated response.
Visibility
Broader and contextualized understanding.
Discover the key modules of Blockbit XDR:
Endpoint Threat & Attack Protection
Protects endpoints against malware, advanced threats, and attacks through both signatures and behavior to block malicious activities and suspicious processes.
Compliance Management
Automates continuous monitoring and compliance with laws, regulations, and standards such as LGPD, PCI DSS, GDPR, ISO 27001, and NIST, ensuring efficient and ongoing management.
Active Response & Automated Remediation
Automatically mitigates threats, with actions on processes (kill, suspension, and restore), endpoint isolation, sending to sandbox, and user notification — stateless and stateful responses.
Application Allowlisting & Blocklisting
Configures and manages application allowlists and blocklists, ensuring that only authorized software runs on systems, preventing the execution of malicious applications.
Behavioral Analysis
Detects anomalies or standard behavior deviations that may indicate a threat, including monitoring user and application behaviors to detect suspicious activities.
File Integrity Monitoring (FIM)
Monitors the file system by detecting changes in content, permissions, ownership, and attributes, and identifies the users and applications used to create or modify files.
Threat Hunting
Advanced investigation and research to identify attack patterns and suspicious activities not detected by traditional defense mechanisms.
Host Intrusion Prevention System (HIPS)
Proactively protects by blocking vulnerability exploitation, brute force, and malware. Includes virtual patching, inline action (drop/TCP RST), and network sensor mode (IDS via SPAN).
Asset Inventory & Visibility
Real-time inventory and visibility of your assets, such as installed applications, running processes, open ports, network interfaces, hardware, and operating system information.
Cloud Security
Visibility and protection for workloads in cloud environments, integrating with platforms like Azure, AWS, Google Cloud, Microsoft 365, GitHub, and Docker, monitoring services, virtual machines, and activities.
Vulnerability Detection
Detects vulnerabilities (CVE) on assets, with a prioritization dashboard, severity counters, CVSS (base, temporal, and environmental), query language search (DQL), and CSV export.
Containers Security
Monitors and analyzes activities within containers, such as Docker and Kubernetes, to detect and respond to threats like container breaches or configuration vulnerabilities.
Configuration Assessment
Continuous assessment of security configurations of systems, devices, and applications, proactively ensuring compliance with internal standards, hardening policies, and regulations.
Multi-Source Log Collection & Management
Continuous assessment of security configurations of systems, devices, and applications, proactively ensuring compliance with internal standards, hardening policies, and regulations.
Secure Internet Gateway
Filters content and controls endpoint access to the Internet, also providing advanced protection against phishing and malicious callbacks, ensuring proactive security for workstations and servers.
Malware Sandboxing
Natively integrated, emulates and executes suspicious files in the Blockbit cloud, analyzing behaviors with AI and ML to identify and examine threats detected in the environment.
Network Detection & Response (NDR)
Expands environment visibility by analyzing network communications and behaviors, identifying lateral movement, suspicious callbacks, data exfiltration, and correlating with endpoint events.
Endpoint Control Center
Unified endpoint management console with topology map, bulk actions with MFA, Soft/Moderate/Hard profiles, USB/Bluetooth control, firewall by FQDN/CIDR, and antitamper module.
Features
Features / ItemsBlockbit XDR
Sensors
- Integrations with more than 150 market solutions
Management
- Available in the Blockbit Cloud
- Accessible via web browser, without requiring additional software installation
- Allows unified or distributed access
- Centralized administration architecture
- Mitre Basic Dashboard
- Mitre Attack Framework Dashboard (by stage and techniques)
- Mitre Radar Dashboard (by applications, files, OS, and network)
- Attack Map Dashboard (attack origin)
- Custom Dashboards
- Custom dashboards with multiple visualization types (time series, bar, pie, tables, and maps)
- Reports
- API
- RESTful API with CRUD operations per resource, role-based access control (RBAC), TLS 1.2+, webhooks, and usage logging (logs)
- CLI
- Allows remote execution of complete commands and scripts in CMD/DOS (.bat), PowerShell (.ps1), and Bash (.sh) formats
- Graphical interface for manager configuration
- Graphical interface for agent configuration
- Granular agent configuration by profile, with individual activation of modules and protections
- Internet access visibility
- SSO (Single Sign-On) Integration: LDAP
- SSO (Single Sign-On) Integration: Microsoft Active Directory
- SSO (Single Sign-On) Integration: SAML
- Remote Syslog for log forwarding and auditing
- Multifactor Authentication
- Endpoint Control Center: unified console with topology map by VLAN and posture counters
- Bulk actions center with MFA validation (scanning, isolation, update, rollback)
- Agent update panel with target version, scheduled window, and rollback by hash
- Response script library (.ps1/.bat/.sh), in persistent or transient mode
- Topology map with latency indicators per node and per hop, and exposed services/ports classified by criticality
- Search and detection of IOCs (Indicators of Compromise)
- Report export in CSV/XLS, text, and PDF
- Notifications via Email, Remote Syslog, Webhook (HTTP/S), Messaging (RabbitMQ, Kafka), Amazon SNS, Google Cloud Pub/Sub, Azure Event Hub
- Real-time inventory of all assets that have the agent installed, providing: - Hardware, operating system, installed software, running processes, ports in LISTENING mode, network interfaces, configured IP addresses
- Per-device dashboards with hardware summary and collection statistics exportable to CSV
- Compliance dashboards and MITRE ATT&CK mapping per asset
- Quarantined files, displaying: Threat name, infected file, and status
- Offers actions such as: Threat details, secure file download, file restoration on the endpoint, sending to Sandbox, future execution (Allowlist), and permanent removal
- Quarantine list export in CSV (threat identification, file, hash, path, status, action, and date, among other fields)
Extended Security
- SIEM
- Native integration with Threat Intelligence
- User and Entity Behavior Analytics (UEBA)
- Mechanisms for detection, protection, and response to Insider Threats
- IoT/IIoT monitoring
- Integration with third-party Network Detection and Response (NDR)
Threat Intelligence
- Anomaly Detection with Blockbit Threat AI
- Anomaly Detection with Machine Learning
- Native integration with market CTI
- Native integration with Blockbit CTI
- Native integration with Blockbit Sandbox
- Integrations with external databases (Malwarebazaar, Maltiverso, Hibryd Analyzer, and VirusTotal)
- Process tree visualization
- Incident responses based on frameworks: MITRE ATT&CK, OWASP, CVSS, or NIST
Endpoint Protection
- Supported Operating Systems (Windows, Linux, MacOS, and Unix)
- Operation on operating systems with encrypted disks (FileVault, BitLocker, LUKS, among others)
- Integrated EPP/EDR
- EPP/EDR Orchestration
- Host IPS
- Host IPS inline: descarte de pacotes (drop) e encerramento de conexões TCP (reject/TCP RST)"
- Modo sensor de detecção de intrusão de rede (IDS) via porta espelhada (SPAN/mirror)"
- Base de assinaturas de Host IPS com mais de 100.000 regras mantidas pelo Blockbit Labs"
- Seleção do conjunto de regras de Host IPS (endpoint ou rede) por perfil de segurança"
- Visualization and management of Host IPS rules by identifier (SID), with filters and custom rule creation
- Vulnerability detection and mitigation with Virtual Patching
- Configuration Assessment
- Configuration Assessment (SCA) e File Integrity Monitoring (FIM) com parâmetros e regras configuráveis por perfil"
- Controle de flood com limiar configurável de eventos"
- Agent update via management console and peer-to-peer (P2P)
- Malware Detection - Hash
- Malware Detection - Behavior
- Malware Detection - YARA (manager)
- Malware Detections - YARA (endpoint)
- Rootkit Detection
- Advanced Exploit Protection – DEP (Data Execution Prevention), SEH (Structured Exception Handler Overwrite Protection – SEHOP), Null Dereference, Null Pointer Attacks, Heap Spray Protection, among others
- File Integrity Monitoring
- Threat Hunting
- Vulnerability Detection
- Vulnerability dashboard with top 10, distribution by year, and severity counters
- CVSS base, temporal, and environmental scoring, with query language search (DQL)
- Web content filter
- Internet access control
- Advanced protection against phishing
- Advanced protection against malicious callbacks
- Application Control
- Incident Response Automation (SOAR)
- Actions on running processes: termination (kill), suspension, and resume (restore)
- Stateless and stateful responses with automatic rollback and end-user notification
Endpoint Protection
- Tamper protection (Anti-Tamper)
- Password to uninstall agent on Endpoint
- Security Backup and Incident Recovery
- USB and Bluetooth media blocking
- Read-only mode for USB and Bluetooth
- Exceptions for USB and Bluetooth (name, vendor, serial number, combination)
- Endpoint firewall supporting rule definition by FQDN (including wildcard), IP address/CIDR, port, protocol, and traffic direction
- Soft, Moderate, and Hard security profiles with automatic cloning and propagation
- Specific protection against Ransomware attack
- Specific protection against Phishing attack
- Specific protection against Zero-Day attack
- Protection and detection of Potentially Unwanted Programs (PUPs)
- Protection against malware and unknown attacks
- Protection against malicious PowerShell scripts
- Protection against malicious CScript scripts
- Protection against data exfiltration
- Local Firewall rule orchestration
- Protection against lateral movement
- Advanced visibility into network communications
- Behavioral traffic and session analysis
- Passive network activity monitoring
- Identification of suspicious communications
- Correlation of activities between hosts and services
- Lateral movement detection between assets
- Identification of suspicious callbacks and beaconing
- Detection of anomalous variations in traffic patterns
- Correlation between endpoint, network, and identity events
- Behavior-based data exfiltration detection
- Network event enrichment with threat intelligence
- Automated incident prioritization with network context
- Automated response to malicious communications
- Incident investigation with session and flow context
- Protection against viruses, trojans, worms, spyware, exploits, fileless, "Side Load DLL", adware, and other types of malicious code
- Protection against Overflow attacks
- Protection against changes in "Live Memory (RAM)"
- Protection against "drive-by download" attacks
- Protection against macro exploitation in Microsoft Office files
- Automated protection against webshell and remote shell
- Protection and Detection against cryptocurrency miners
- Protection against privilege escalation
- Shadow Copy protection
- ZipBomb protection
- Regular Backups*
- Offline monitoring
- Advanced protection against evasion techniques - code modification, polymorphism, cryptography, parker, among others
Compliance
- LGPD
- PCI DSS
- GDPR
- HIPAA
- NIST
- TSC
- ISO 27001
- GPG13
Cloud Security
- Container Monitoring
- Cloud Workload Protection
- AWS
- Azure
- Microsoft 365 (email protection, account protection, and file protection - One Drive and SharePoint)
- Data Loss Prevention - DLP (protection for Microsoft 365)
- Google Cloud (email protection and account protection)
- GitHub
- Docker
Blockbit Sandboxing
- Dynamic and behavioral analysis of suspicious files in a controlled environment
- Detection of unknown malware (zero-day) and advanced persistent threats (APT)
- Inspection of compressed, obfuscated, and SSL/TLS encrypted files
- Identification of malicious behaviors with AI and Machine Learning
- Continuous update of signatures and threat intelligence via Blockbit Labs and CTI
- Real-time blocking and recurrence prevention with automatic signature creation
- Analysis of network communication, malicious callbacks, and process tree
- Support for artifacts up to 100MB in size
- Support for analyzing any file type, regardless of operating system (Windows, Linux, and macOS), including, among others, BAT, CHM, DLL, EXE, ISO, HTA, JAR, JS, JSE, LNK, MSI, MHTML, Microsoft Office, PE32, PDF, VBE, VBS, WSF, XML, as well as typical formats such as SH, ELF, BIN, APP, and PKG, and compressed and chained files such as ZIP, TAR, GZIP, BZ2, RAR, and 7Z
- Emulation of Windows (7–11, Server 2008–2025), Linux, and macOS environments
- Multi-phase verification: hash, allow/block list, Blockbit Labs, antivirus, and sandbox
- Native integration with Blockbit solutions: NGFW, NDR, SIEM, SOAR, and XDR, in addition to REST API integration, enabling advanced analysis and coordinated response
Infrastructure
- Redundancy
- Backup
- Automatic Scalability
- Environment protection
Services
- 24x7 SOC Monitoring
- 24x7 Dedicated Support
- Proactive Incident Response
- Detailed and Customized Reports
- Advanced Response Automation (via SOAR)
- Incident Investigation by Specialists
- False Positive Reduction (SOC tuning)
- Regulatory Compliance Tracking
- Continuous Rule Management and Tuning
- Access to Proprietary Threat Intelligence
* Note: It is mandatory to maintain at least 15% of the total partition capacity available for backup storage, ensuring sufficient space for snapshots and Shadow Copies.
Section