Six capability areas for daily operations
Developed by Nantong Guanyuan Xingju Technology, StarWard XDR connects assets, data, rules, evidence and people across risk discovery, investigation, controlled response and review.
When assets, alerts, risks and tickets are scattered, investigation and handover require repeated checks. StarWard XDR organizes six capability areas into an operational chain with ownership, evidence, execution receipts and review records.
Multi-source data collection
Collect connected records through collectors, imports and authenticated APIs; diagnose missing fields, delays and source activity with asset context.
Alert analysis & threat detection
Investigate with rules, searches, threat hunting and imported intelligence, supported by custom detections, revision history and read-only replay.
Investigation & evidence relations
Use timelines, evidence relationships and triggering-rule snapshots to support assignments, investigation and reviewed closure.
Controlled response automation
Organize runbooks, authorize and approve adapted actions, retain execution receipts and supported expiry recovery, and escalate unknown results for human review.
Managed-operations collaboration
Support authorized service teams with roles, assignments, tickets, audits and review materials. Service hours and commitments depend on the agreed service plan.
Exposure & vulnerabilities
Maintain asset and software inventories, match software risks, run read-only checks and link remediation with retesting. Discovery coverage continues to expand through validation.
Designed around operational needs
Connect assets, incidents and tasks for owner-led investigation, remediation and handover.
Investigate unusual logins or requests with timestamps, sources and asset context before controlled response.
Review software data, risk matches and check history, linking remediation tickets and retest results.
Review evidence, rule conditions, response receipts and handling steps to improve detections and runbooks.
Deployment, integration & verified scope
Enterprise private deployment is available; SaaS delivery capabilities remain under development. Authenticated event APIs, log imports and third-party adapters connect existing environments. Domestic-platform compatibility and integrations are delivered within explicitly verified scopes.
