Four stages. Zero blind spots.
16 specialised telemetry engines observe system internals without degrading host performance.
Continuous Endpoint Visibility & Host Defense
16-Engine Endpoint Telemetry
High-frequency host observation capturing process trees, network sockets, DNS queries, registry modifications and PowerShell execution.
Core IngestionRansomware Canary Decoys
Tripwire files monitored with sub-millisecond interrupts detect mass-encryption before user files are touched.
Early WarningUSB & Peripheral Watchdog
Identifies rogue HID devices (BadUSB), mass-storage injection and unauthorised data extraction vectors.
Physical VectorsWindows Defender Coordination
Synchronises with native Defender telemetry to correlate AV signatures with real-time process behaviour.
Ecosystem SyncBehavioural ML & MITRE ATT&CK
Genuine IsolationForest ML
Real scikit-learn IsolationForest anomaly detection over 10-dimensional behavioural feature vectors.
Unsupervised MLMITRE ATT&CK Matrix Mapping
Every alert is cross-referenced against standardised MITRE tactics and techniques for clear SOC context.
Standard FrameworkParent-Child Process Anomaly Engine
Flags Office documents or web servers spawning PowerShell, cmd.exe or scripting interpreters.
Execution DefenseDNS Tunneling & DGA Identification
Analyses query frequency, Shannon entropy and character distribution to expose C2 beacons and exfiltration.
C2 DisruptionThreat Intelligence & Composite Risk Scoring
KAVACH Security Score Engine
A real mathematical composite of network health, device status, threats, applications and identity posture.
Posture MetricIOC & Threat Intel Enrichment
Queries feeds for malicious IPs, SHA-256 malware hashes, phishing domains and rogue infrastructure.
Threat IntelMulti-Event Incident Correlation
Groups isolated alerts across endpoints and network into unified incident clusters showing the full attack chain.
Incident EngineDual-Mode Experience
A reassuring view for general users and a raw telemetry terminal for cybersecurity professionals.
Adaptive UIControlled SOAR Automation & URL Security
Autonomous & Controlled SOAR
Response workflows built around safety and authorisation, with dry-run verification and rollback.
Response EngineKAVACH URL Shield
Checks links for homograph attacks, typosquatting, private-IP access (SSRF) and suspicious lexical structure.
Web DefenseChromium MV3 Browser Shield
Lightweight Manifest V3 extension with real-time URL inspection and phishing warnings.
Browser ExtensionImmutable Audit Trail & Rollback
Every playbook run, block and admin action is recorded in a cryptographically verifiable audit log.
Audit & SafetyWhere KAVACH differs from traditional tools
Antivirus looks for known files. KAVACH watches behaviour, so it still works when the malware is brand new.
| Signature antivirus | Typical EDR | KAVACH | |
|---|---|---|---|
| Detects unknown threats | Rarely | Sometimes | Yes, rules plus IsolationForest ML |
| Explains what happened | No | Raw alert text | Plain-language, via Raksha AI |
| Automated response | Quarantine file | Vendor-managed | Authorised SOAR playbooks with dry-run |
| Where data lives | Vendor cloud | Vendor cloud | Your own systems |
| Audit trail | Basic log | Retention-limited | Immutable, hash-chained ledger |
Things people ask first
Short answers about running the agent day to day.
The collectors are built to observe system internals without degrading host performance. Heavy analysis runs away from the user session.
Yes. Administrators can enable or pause each of the 16 collectors from the console, and every change is written to the audit log.
Yes. KAVACH reads Defender telemetry and correlates its verdicts with live process behaviour instead of replacing it.
Ready to see it in action?
Sign in to the operations console or follow the onboarding guide to deploy your first agent.