TURKISH-BUILT EDR
Detect.Stop.Investigate.
When a threat reaches the endpoint, SAVA EDR catches it by behavior and responds: it terminates the process, quarantines the file and isolates the host from the network.
Email attachment opened
invoice_2026.pdf.exe
Process chain started
outlook.exe → invoice.exe → powershell.exe -enc …
Outbound connection attempted
powershell.exe → 203.0.113.7
SAVA Agent caught the chain
Behavior analysis: suspicious chain
Response applied
Process terminated · File quarantined · Host isolated
Contained
Link to the management console stays open
- LOCAL
- Developed in Türkiye
- SUPPORT
- Support in Turkish
- PLATFORM
- Windows, Linux, macOS
- DEPLOY
- On-premises, private cloud, hybrid
DETECT / RESPOND
What happens when a threat gets in?
Five steps, from an email attachment reaching the endpoint to the incident being closed.
01 / ARRIVE
Threats don’t always stop at the door.
An email attachment reaches the user, and the user opens it. Once the perimeter has been passed, the real question is: what is happening inside the endpoint?
02 / EXECUTE
The process tree grows the moment it runs.
The attachment opens and starts new processes. The chain outlook.exe → invoice.exe → powershell.exe becomes visible, and the suspicious branches are flagged.
03 / OBSERVE
SAVA Agent watches every process.
The agent collects process, file and network events. Behavior analysis ties the suspicious chain into a single alert.
- process.create outlook.exe → invoice.exe
- file.write %TEMP%\invoice_2026.pdf.exe
- process.create invoice.exe → powershell.exe -enc …
- network.connect powershell.exe → external address
- Suspicious chain: encoded PowerShell command
04 / RESPOND
Stop it: process, file, network.
The process tree is terminated from its root. The file is quarantined. The host is isolated from the network; its link to the management console stays open.
05 / INVESTIGATE
Investigate.
The incident is on record in the console with a timeline, the affected host and the actions taken. Your team sees what happened and what was done.
- Affected host
- WS-0142
- Status
- Contained
01 / ARRIVE
Threats don’t always stop at the door.
An email attachment reaches the user, and the user opens it. Once the perimeter has been passed, the real question is: what is happening inside the endpoint?
02 / EXECUTE
The process tree grows the moment it runs.
The attachment opens and starts new processes. The chain outlook.exe → invoice.exe → powershell.exe becomes visible, and the suspicious branches are flagged.
03 / OBSERVE
SAVA Agent watches every process.
The agent collects process, file and network events. Behavior analysis ties the suspicious chain into a single alert.
04 / RESPOND
Stop it: process, file, network.
The process tree is terminated from its root. The file is quarantined. The host is isolated from the network; its link to the management console stays open.
05 / INVESTIGATE
Investigate.
The incident is on record in the console with a timeline, the affected host and the actions taken. Your team sees what happened and what was done.
Event stream
- process.create outlook.exe → invoice.exe
- file.write %TEMP%\invoice_2026.pdf.exe
- process.create invoice.exe → powershell.exe -enc …
- network.connect powershell.exe → external address
- ▸Suspicious chain: encoded PowerShell command
- ▸ Process tree terminated
- ▸ File quarantined
- ▸ Host isolated
Incident summary
Example scenario
- Affected host
- WS-0142
- Timeline
- 14:02:11 invoice.exe started
- 14:02:12 Suspicious chain detected
- 14:02:13 Process tree terminated
- 14:02:13 File quarantined
- 14:02:14 Host isolated
- Status
- Contained
CONSOLE
See it in the console.
All endpoints, alerts and vulnerabilities in one management console.
HOW IT WORKS
Deploy. Detect. Respond.
Three steps. The management server runs in the environment you choose.
- 01
Deploy
Install the management server on-premises, in a private cloud or as a hybrid. Roll the agent out to your endpoints.
- 02
Detect
The agent collects process, file and network events. Behavior analysis turns suspicious events into prioritized alerts.
- 03
Respond
From the central console, terminate the process, quarantine the file, isolate the host.
CAPABILITIES
Four jobs on the endpoint.
Each is managed from the console.
DETECT
Detection by behavior
Continuously collects process, file and network events and identifies suspicious application and user behavior.
RESPOND
Three actions
Terminates the process tree, quarantines the file, isolates the host from the network.
INVESTIGATE
Incident timeline
Shows which host an incident happened on, in what order, and which actions were taken.
REPORT
Reports and vulnerabilities
Reports on security events and system status; lists vulnerabilities by severity and affected system.
DEPLOYMENT
Where does it run?
Operating system support and deployment models.
Support scope varies by version. Write to us for the current list.
TRUST AND DATA
What does the agent do, and where does data live?
The questions you should ask before installing any security product.
What the agent collects
Process, file and network events. The full list is on the Trust page.
Where data is stored
In on-premises and private cloud deployments, the management server runs in your infrastructure.
Developed in Türkiye
The product is developed in Türkiye and support is provided in Turkish. Few companies in Türkiye develop cybersecurity products; we are one of them.
KVKK
Our notice on the processing of personal data is published.
FAQ
Straight answers.
What is EDR?
EDR (Endpoint Detection & Response) is a security approach that monitors process, file and network events on endpoints such as computers and servers, detects suspicious behavior and lets you respond to incidents.
What is the difference between EDR and antivirus?
Antivirus traditionally focuses on blocking known malware. EDR monitors events on the endpoint, finds suspicious behavior chains, keeps an incident record and provides response actions such as terminating a process, quarantining a file or isolating a host.
What does “Turkish EDR” mean?
A Turkish (yerli) EDR is an EDR product developed in Türkiye. SAVA EDR is developed in Türkiye by SAVA Cybersecurity, with support in Turkish. This is not a claim of any certificate or official status.
What is SAVA EDR?
An Endpoint Detection & Response product that monitors events on endpoints, detects suspicious behavior and lets you respond to incidents. It is developed in Türkiye.
What responses can it perform?
It terminates the process tree, quarantines the file and isolates the host from the network. All are managed from the central console.
What does it not do?
It does not replace perimeter security: it complements your firewall or email gateway. SAVA EDR catches a threat not at the door but inside the endpoint, by its behavior. It also examines the network connections and traffic of the endpoint, which puts it a step beyond a classic EDR, closer to an XDR approach. No product guarantees one hundred percent protection, and we don’t either.
Which operating systems does it support?
Windows, Linux and macOS. Support scope varies by version; ask for the current list through the contact form.
What does the agent collect?
Process, file and network events. Details are on the Trust page.
Where is data stored?
In on-premises and private cloud deployments, the management server runs in your infrastructure. For hybrid deployments we settle the architecture during the demo.
How is it installed?
First the management server, then the agent on endpoints. After that, all hosts are managed from one console.
How do I get a demo?
Fill in the form on the contact page. We reply by email.
See it in your environment.
In a short demo we show what SAVA EDR sees on your endpoint and what it responds to.