Malwarebytes Endpoint Detection & Response

What is included in Malwarebytes Endpoint Detection & Response?

Nebula cloud console – Central policies, groups and reporting for every managed endpoint.
Suspicious activity monitoring – Behavioural detection mapped to the MITRE ATT&CK framework.
Ransomware rollback – Restores encrypted Windows files up to seven days back.
Three isolation modes – Network, process and desktop isolation, manual or automatic.
Active Response Shell – Remote command shell for Windows, macOS and Linux.
Important – Patch management, drive encryption and DNS filtering are separate modules.

What are the main benefits of Malwarebytes Endpoint Detection & Response?

Malwarebytes moved its business products to the ThreatDown brand in November 2023, so this product appears as ThreatDown Endpoint Detection & Response in the vendor's current documentation. It installs one agent per device and is administered centrally, in the Nebula console for a single organisation or in the multi-tenant OneView console used by service providers.

One agent – Prevention, detection and response ship in a single installer.
Rollback instead of restore – Reverses ransomware damage without opening a backup set.
Faster containment – Critical alerts can isolate a device automatically.
Root cause visibility – Process graphs show how the infection actually started.
Remote remediation – Clean and inspect home office devices over the internet.
Evidence for audits – Detection records stay available for 365 days.

Best antivirus? Why Windows Defender alone is not enough
Explains where the protection built into Windows stops and why companies add a second, centrally managed layer.

Which company size is Malwarebytes Endpoint Detection & Response suitable for?

Company size decides less here than sector and staffing. Swiss reporting duties follow the sector, not the headcount, while the practical question for EDR is whether anyone in the organisation reads and triages the alerts it produces.

Does Malwarebytes Endpoint Detection & Response meet the requirements of Swiss cybersecurity legislation?

The reporting duty under the revised Information Security Act applies to operators of critical infrastructure, so most ordinary Swiss companies are affected indirectly, as suppliers, rather than directly. Those who are covered must report a cyberattack to the Federal Office for Cybersecurity (BACS) within 24 hours of discovery, which means the facts have to be assembled the same working day. This product supplies part of that material: the suspicious activity view records when the behaviour was first seen, which processes and files were involved and which MITRE ATT&CK techniques were triggered, and detection records remain retrievable for 365 days. It does not cover the rest of the duty. There is no reporting form, no case management, no notification workflow towards BACS, and no visibility outside the endpoint, so incidents on firewalls, network equipment, cloud services or OT systems will not appear in this console at all. This description is not legal advice, and which obligations apply to your organisation should be confirmed with qualified counsel.

Does Malwarebytes Endpoint Detection & Response meet the requirements of European cybersecurity legislation?

No product makes an organisation compliant with the NIS 2 Directive, because the directive addresses management responsibility, risk analysis and documented processes, not software features. NIS 2 requires a set of risk-management measures that includes incident handling, business continuity and backup management, supply chain security, access control and identity handling, vulnerability treatment, cryptography, and staff awareness training. This product contributes to two of those categories in a concrete way: incident handling, through behavioural detection, endpoint isolation and remote remediation, and vulnerability treatment in a partial sense, since vulnerability assessment and patch deployment are separate modules rather than part of the EDR function. The remaining categories are not addressed. Backup and restore, identity and access control, multi-factor authentication, cryptography beyond the separately licensed Windows drive encryption module, supplier assessment and user training all have to be covered elsewhere, and endpoint telemetry alone will not satisfy an auditor asking how continuity is tested.

Does Malwarebytes Endpoint Detection & Response help with security questionnaires from large customers?

Yes, for the endpoint chapter, and only for that chapter. It answers the questions on managed anti-malware coverage across all workstations and servers, behavioural detection beyond signatures, the ability to isolate a compromised device, remote forensic access through the response shell, threat hunting across thirty days of endpoint events, and a detection history kept for 365 days that can be exported as evidence. It does not answer the questions that usually sit next to those. Multi-factor authentication, identity monitoring, backup and tested restore, patch installation with an SLA, disk encryption on anything other than Windows workstations and only with the separate module, email and phishing filtering, mobile device management, penetration testing, and 24/7 monitoring by named analysts are all outside its scope, and so is the question about where console data is processed, which should be put to the vendor in writing before signature. Where the gaps matter commercially, moving up within the same family is usually the cheaper route than adding a second vendor: patch management, drive encryption, DNS filtering, mobile security and the managed detection service are all administered from the same console and the same agent, whereas a second product means a second agent, a second console and a second set of exclusions to maintain.

What is the difference between Endpoint Protection and Endpoint Detection & Response?

The decisive difference is what happens after something gets through: Endpoint Protection blocks and quarantines, while Endpoint Detection & Response additionally records what the process did and lets you reverse it. Both use the identical agent and the identical console, so the upgrade is a licence and policy change rather than a redeployment. Endpoint Protection is the right level where an administrator only wants malware stopped and cleaned. Endpoint Detection & Response is the right level where someone has to answer how an infection started, contain a device within minutes, or recover files that were already encrypted.

Test: Antivirus program: Best antivirus programs for Windows 2025
Compares the current Windows antivirus products and shows where pure prevention ends and detection and response begins.

Which limitations should you know before buying?

Ransomware rollback is a Windows feature only, and its window is configurable between one and seven days with three days as the delivered default, so a Mac or Linux device gets detection and isolation but no file recovery. Isolation is likewise uneven across platforms: network and process isolation work broadly, while desktop isolation, the mode that locks the user out of the screen, exists on Windows only, and process isolation is not available on macOS 10.13 and 10.14. Flight Recorder search, the function that lets you look back over thirty days of process, file, registry and network events, is switched off by default and has to be enabled in the policy, which is worth checking during the pilot rather than during an incident. Server Core installations and non-persistent VDI are not supported, all Linux devices are counted as servers regardless of their role, and behavioural monitoring on servers is a separate policy switch that adds load to the machine. The console itself is cloud-only, with Nebula for a single organisation and OneView for service providers managing several customers; there is no on-premises variant, so the data processing location is determined by the vendor and not by you.

Data loss is expensive: How backups help you avoid outages
Sets out why rollback and backup solve different problems and where a recovery plan still needs a real backup.

Frequently asked questions about Malwarebytes Endpoint Detection & Response

Does ransomware rollback replace a backup?

No. Rollback works from a cache held on the endpoint itself, limited by a configurable share of free disk space and by a maximum file size, so files above that size are never copied. If the device is wiped, stolen or its disk fails, the cache goes with it, which is why rollback shortens recovery after an encryption event but does not remove the need for a separate backup.

Are servers covered as well as workstations?

Yes, the same agent runs on Windows Server and on supported Linux distributions, and every Linux device is counted as a server in the console regardless of what it does. Behavioural monitoring on servers is enabled by its own policy toggle, and rollback on a server additionally requires that toggle to be active. Server Core installations are not supported.

Can detections be forwarded to a SIEM?

Yes, threat events can be sent in CEF format to a syslog server or SIEM, and there is also a dedicated integration for Google Chronicle. The syslog path requires one Windows endpoint to be promoted as the communication device, and it buffers only the last 24 hours if it cannot reach the console, so a longer outage will leave a gap in the exported data.