Understand what a Windows workstation is doing before you change it.

KairnexXray reviews local connections, processes, startup items, services, security settings, and recent events so an authorized team can investigate with useful context.

Current pilot use is local-first. It preserves context and prepares a response plan before any approved containment step is applied.

Ask about an Xray source pilot See all evidence sources

Endpoint sourceKairnexXray

Host signalsProcesses, connections, persistence

Sensor healthDefender, firewall, updates, logging

Response contextTimeline, baseline, planned action

Evidence recordRedacted endpoint summary

Local inspection

Find suspicious behavior without sending raw workstation logs to a public service.

Xray focuses on current host signals: active connections, listening ports, process paths, startup entries, scheduled tasks, services, DNS cache names, baseline drift, Defender posture, and Windows event context.

1Scan

2Inspect

3Baseline

4Trace

5Plan

What your team can review

Enough context to decide whether to watch, investigate, contain, or escalate.

KairnexXray is designed for defensive investigation and support handoff. It gives a reviewer enough context to decide whether to observe, investigate, contain, or escalate.

Host IDS scan

Review process context, network listeners, public outbound connections, startup entries, scheduled tasks, and services.

Focused inspection

Inspect a finding by alert, PID, file path, or remote host with hashes, signatures, persistence references, and DNS context.

Sensor health

Check Defender state, firewall posture, PowerShell logging, audit policy, update health, and core security services.

Safe containment planning

Generate dry-run response plans before applying reversible actions such as host blocks, process stops, or startup disablement.

Response posture

Preserve evidence first, then decide what to change.

KairnexXray is intentionally conservative. It does not claim that a machine is clean, and it does not make destructive changes by default. The product helps teams slow down, collect useful local context, and make a documented response decision.

Read-only by default Scans, inspections, event timelines, Defender traces, and health checks preserve context before action.

Evidence handoff Reports, structured alerts, snapshots, timelines, health checks, and response plans can be packaged for review.

Baseline drift Compare current listeners, processes, startup entries, tasks, and services against a known-good baseline.

Admin-aware containment Elevated actions are visible, planned, and logged with restore notes when containment is applied.

Security boundaries

Defensive local triage only.

KairnexXray is not an offensive tool, not a malware database, and not a full EDR. It is a local investigation layer for authorized users and support teams working on approved Windows hosts.

No remote exploitation, credential theft, persistence, or offensive automation

No cloud upload requirement for current local-first operation

Containment is planned through dry-run checks before apply mode

Reports are designed for customer-controlled review and support handoff