ERA Core (XDR)Security platform foundation

The base XDR edition: one lightweight agent on hosts, telemetry ingestion, a data lake in your data center, Sigma rule-based detection mapped to MITRE ATT&CK, asset inventory, and case management in the SOC portal. All data stays in the perimeter — no cloud and no phone-home. This is the starting point for any ERA One deployment.

Purpose

Deliver a complete "event → detection → case → investigation" cycle in an isolated perimeter. Suitable for banks, public sector, and industry with on-prem / air-gap requirements.

End-to-end pipeline: agent → ingest → queue → storage → detection → cases.
Unified event format; personal data masked on the agent before transmission.
Offline licensing, no telemetry sent outbound.

Key capabilities

Windows / Linux / macOS agent — processes, network, logins.
Detection rule library mapped to MITRE ATT&CK; extensible rule corpus.
SOC Portal: cases, assets, events, detections; analyst / admin / viewer roles.
Built-in indicators of compromise (IoC) handling and event enrichment.
Immutable storage for investigations and regulatory reporting.

Who it's for

Minimum deployment to launch a SOC from scratch or replace a foreign XDR in a closed perimeter. Often complemented by ERA Control AI and ERA Response editions.

Deployment modes

The platform supports two profiles — same product, different configuration:

Sovereign (air-gap): full isolation; rule, CVE, and AI pack updates delivered via offline package on removable media.
Sovereign Hybrid: data, data lake, and investigations remain in the perimeter, while licenses and protection updates are pulled automatically from the ERA cloud over an outbound channel.

Hybrid mode is enabled deliberately and governed by policy: raw data, personal information, and cases are never sent outbound. Ideal for banking with a "data at home — support like the cloud" model.

Licensing

The base ERA Core license is required for any bundle. Includes the telemetry platform, detection engine, and SOC portal.