Full EDR.
Built in, not bolted on.
Convoy Agent prevents, detects and responds on every host, collects your logs and inventory while it's there, and puts all of it in the same source of truth as your identities, inboxes, firewalls and cloud. One process does what used to take three agents and two vendors. Already happy with your EDR? Keep it. The EDR in Convoy Agent is optional.
$ convoy-agent status
Why it matters
A standalone EDR sees the laptop. We see the attack.
The laptop, the account signed in to it, the email that started it and the firewall it talked through. Convoy Agent is what puts the endpoint in that same picture.
One lead, not two alerts
The host event and the identity event that goes with it land on the same lead, so triage starts with the whole story.
Response across every surface
One playbook isolates the host, disables the account and purges the message, without handing anything to another tool.
Fewer agents on the box
Protection, log collection and inventory from one process instead of three.
No extra contract
Convoy Agent is part of your Convoy agreement. There's no separate EDR license to renew.
What it does
Full EDR, plus the log collection that used to need its own agent.
Six verbs, one process, on every host. The same process finds the AI agents on each machine for Airspace.
convoy-agent · rdweb01 · readout
Blocks malicious execution on the host and tells Convoy what it stopped and why. The block itself becomes a lead, with the process tree attached.
Watches process, file, registry, network and logon activity, matched on the host and in the platform against 2K+ Guard rules. Same rules, same data as your identities and inboxes.
Isolates the host, stops the process and quarantines the file, by hand, from your own AI tools over MCP, or from an Autopilot playbook. Every action is recorded with who or what triggered it.
Ships Windows event logs and host telemetry into Convoy from the same process. Delete the forwarder your SIEM needed.
Reports every host it runs on, who logs on and what runs, straight into Fleet, where each asset gets a risk score and a compliance state.
Every event it sends is queryable next to your identity, email and network data. Nothing is sampled, tiered or archived early.
Your EDR, or ours
Keep your EDR, run both, or switch. It isn't all or nothing.
We already ingest the major third-party EDRs, so your current agent reports into the same leads either way. Convoy can isolate a host through it, too. The EDR in Convoy Agent is a choice, not a requirement. Pick the setup that fits today and change it whenever you like.
1
Keep your EDR
Leave it in place. Convoy ingests it, and Convoy Agent runs with its EDR switched off, covering log collection and inventory.
2
Run both and compare
Turn Convoy's EDR on next to yours. See what each caught, what each missed and what each cost the host, lead by lead.
3
Switch when it suits you
Retire the old agent at renewal, or never. Rules, history and cases stay in Convoy either way, so nothing restarts from zero.
| Convoy Agent | A standalone EDR | |
|---|---|---|
| Log collection | Built in | A second agent or forwarder |
| Where alerts land | A Convoy lead with identity, email and network context | Its own console |
| Response reach | Endpoint, identity and email in one playbook | Endpoint only |
| Who watches it | Convoy operators, as much or as little as you want | Your team, or an MDR add-on |
| Licensing | Included | A separate contract |
Put Convoy Agent on every host.
Push it through the tools you already use. Keep your current EDR, or run both and keep the one that caught more.