ProductsDeception Platform
What’s included
One platform, no feature tiers. Every client gets every capability.
| Detection | |
|---|---|
| Kerberoasting detection | Included |
| AS-REP Roasting detection | Included |
| DCSync detection | Included |
| Pre-2000 machine account detection | Included |
| Shadow Credentials detection | Included |
| RBCD detection | Included |
| Certificate services abuse detection | ESC1, 2, 3, 4, 9, 13, and 15 |
| Response | |
| Certificate request blocking | Denied as it alerts |
| Self-repairing decoys | Shadow Credentials and RBCD |
| Automated containment | Opt-in, with guardrails |
| Alert triage, assignment, and notes | Included |
| Assessment | |
| Claymore Exposure Assessment | Scheduled or on demand |
| Remediation guidance for every finding | Included |
| Integrations | |
| Email and Slack alerts | Included |
| Webhooks | Included |
| SIEM | Splunk, Microsoft Sentinel, OCSF, CEF, LEEF |
| PSA | ConnectWise, HaloPSA, Autotask |
| Full API access | Included |
| Platform | |
| Agents | Unlimited |
| Claymore Decoys | Unlimited |
| Continuous decoy verification | Included |
| Event retention | 1 year by default |
| Multi-tenant console for partners | Included |
| Role-based access control | Included |
On-premise deployment and service-level agreements are arranged per contract. Contact us if you need either.
Requirements
What you need to run it
One self-contained agent per server. No runtime, no kernel driver, nothing on endpoints.
- Operating system
- Windows Server 2016 or later, x64
- Installer
- PowerShell 5.1 or later
- Privileges
- Administrator rights to install; the agent then runs as a Windows service (ClaymoreAgent)
- Network
- Outbound HTTPS (TCP 443) only, to the Claymore API and to install-dev.claymorelabs.io during installation. Nothing listens for inbound connections.
Deployment
Agent roles
Choose a role at install: your domain controllers, plus your certificate authority for certificate services coverage.
Domain Controller
domain_controller
- Detects
- Kerberoasting, AS-REP Roasting, DCSync, Pre-2000 machine accounts, Shadow Credentials, and RBCD
- Notes
- Install on every domain controller. They coordinate automatically, so traffic between your own controllers never raises an alert.
Certificate Authority
certificate_authority
- Detects
- Certificate template abuse: ESC1, ESC2, ESC3, ESC4, ESC9, ESC13, and ESC15
- Notes
- Includes Claymore CertGuard, which denies requests against decoy templates so no usable certificate is ever issued.
Stop tuning. Start catching.
Claymore is delivered through managed service and security partners. Bring it to your clients, or let us connect you with a partner who already runs it.