UESP
Open the console

Unified endpoint security platform

One agent.
One console.
One audit log.

UESP replaces a stack of separate security products with one self-hosted platform: threat protection, patching, software delivery, endpoint control, privileged access, compliance and backup, run from one console against one device list, one policy library and one audit log.

Download for Windows Open the console

Windows 10 and 11, 64-bit; installs the desktop app and the agent. The agent alone installs on Linux with one command. Pairs with your organisation using a code from your IT team.

The platform at a glance

Twelve areas of the console.
Three records they all share.

Every module writes to the same device records, the same stream of findings and the same approvals queue. The areas below are the console's own navigation, and every item named is a page in it.

Shared by every module

Devices

Every managed endpoint as one record: hardware and software inventory, groups and enrolment. Windows, macOS, Linux and servers; phones and tablets through mobile device management.

  • Inventory
  • Groups
  • Enrolment
  • Mobile devices

Findings

One stream for threats, vulnerabilities, misconfigurations and broken protection, from every module, against the same device and user records. One place to triage, whichever module raised it.

  • Threats
  • Vulnerabilities
  • Misconfigurations
  • Broken protection

Approvals

One queue for every kind of request: blocked applications, USB devices, elevation, privileged access and patches. Approve, deny or grant for a limited time, with the reason and the decision recorded.

  • Applications
  • USB devices
  • Elevation
  • Privileged access
  • Patches

The modules

Threats (EDR/XDR)

Detections from the agent, correlated into cases, with threat hunting and your own detection rules. Ransomware rollback, email quarantine, file-integrity monitoring on servers and account health live in the same module.

  • Detections
  • Cases
  • Threat hunting
  • Detection rules
  • Ransomware rollback
  • Email quarantine
  • File-integrity monitoring
  • Account health

Patches & vulnerabilities

Missing OS and third-party updates and known-vulnerable software on every device, approved in the console and installed on a schedule. Code and cloud scanning covers the other side: SAST, SCA, secrets, IaC and DAST.

  • OS updates
  • Third-party updates
  • Vulnerable software
  • Code scanning
  • Cloud scanning

Software

Deploy software to groups or publish it to a self-service catalog people install themselves. Inventory, usage metering, prohibited software, licences, warranties and OS deployment are the same module.

  • Deployment
  • Self-service catalog
  • Inventory
  • Usage metering
  • Prohibited software
  • Licences
  • Warranties
  • OS deployment

Endpoint control

Application allowlisting with a learning mode, ringfencing, network and web control, USB and device control, disk encryption with recovery keys, browser control, data loss prevention and configuration baselines, all as policies in one library.

  • Allowlisting
  • Ringfencing
  • Network & web control
  • USB & device control
  • Disk encryption
  • Browser control
  • Data loss prevention
  • Configuration baselines
  • Policy library

Privileged access

A credential vault, just-in-time elevation and recorded sessions, with discovery of the accounts nobody wrote down. SSH keys, TLS certificates, break-glass access, application-to-application credentials and behaviour analytics.

  • Credential vault
  • Just-in-time elevation
  • Recorded sessions
  • Account discovery
  • SSH keys
  • TLS certificates
  • Break-glass
  • App-to-app credentials
  • Behaviour analytics

Compliance

Benchmark results per device and evidence collected from the platform itself, so you can evidence the frameworks your organisation answers to. Audits, a risk register, vendor risk, access reviews, policy attestations, personnel onboarding, security questionnaires and a trust centre. An assistant drafts questionnaire answers; a person approves before anything is sent.

  • Benchmarks
  • Evidence
  • Audits
  • Risk register
  • Vendor risk
  • Access reviews
  • Attestations
  • Onboarding
  • Questionnaires
  • Trust centre

Backup & recovery

Repositories, backups and restore points for the devices you already manage, with replicas and failover, disaster-recovery runbooks and a ransomware recovery path that starts from the same device record as the detection.

  • Repositories
  • Backups
  • Restore points
  • Replicas & failover
  • DR runbooks
  • Ransomware recovery

Reports and audit

Reports and dashboards across every module, and one tamper-evident audit log of every state change, access, credential reveal, session and approval, so the evidence is there when an auditor asks.

  • Reports
  • Dashboards
  • Audit log

Administration

Users and roles, single sign-on and multi-factor authentication, log forwarding to your SIEM, and separation between organisations so a managed service provider can run many customers from one deployment.

  • Users & roles
  • SSO & MFA
  • Log forwarding
  • Multi-organisation (MSP)

One agent

One binary per computer.
It keeps enforcing offline.

One Rust binary per operating system carries every module's endpoint work, so there is one thing to install, one process to trust and one check-in to watch. Windows, macOS, Linux and servers; phones and tablets through mobile device management.

What runs on the endpoint

  • Anti-malware
  • Anti-exploit
  • Anti-ransomware
  • EDR telemetry
  • Application control and ringfencing
  • Data loss prevention hooks
  • Device and peripheral control
  • Web control
  • Privileged-session broker
  • Compliance sensor (osquery)
  • Patching
  • Software delivery

  • Offline, it still enforces

    The last approved policy is held in a tamper-evident local store and enforced with no connectivity at all. Events queue on the device and are delivered when the network returns.

  • Checks in every 60 seconds

    Policy changes, approvals and commands reach the endpoint on its next check-in, so an approval made in the console lands on the computer within a minute.

  • Identified by its own certificate

    Each agent authenticates with its own mTLS client certificate, so the platform knows exactly which device is talking and there is no shared secret to leak.

  • A service, from boot

    On Windows the installer registers the agent as a LocalSystem service that starts at boot and restarts if it stops. On Linux it installs with one command.

How it is built

Self-hosted and policy-driven,
with nothing that is UI-only.

The platform runs on your own infrastructure, and six rules hold across every module. They are the architecture's own, not marketing.

  1. Self-hosted

    UESP runs on your own infrastructure, on Docker Compose today, with your own Postgres, ClickHouse, OpenSearch and object storage. Your device records, session recordings and evidence stay in those stores; there is no vendor cloud holding them.

  2. Policy before action

    Every enforcement action on an endpoint comes from a versioned, approved policy in the policy library. A change is reviewed, approved and versioned before any agent sees it.

  3. One audit log

    Every state change, access, credential reveal, recorded session and approval is written to one tamper-evident audit log, whichever module it came from.

  4. Every action is an API call

    Every console action is also a REST API call. Nothing is UI-only, so whatever an administrator can do by hand can be scripted and automated.

  5. Separated per organisation

    Each organisation's data is separated in the database itself, not only in the interface. It is the same separation a managed service provider relies on to run many customers from one deployment.

  6. Secrets in a vault

    Credentials, keys and certificates live in a vault, never in configuration files. Reveals are brokered, audited and, where possible, avoided by injecting the secret into the session instead.

For the person at the keyboard

The app you download here
is the one you use daily.

The desktop app is not just the agent. It is where you install approved software, see what needs a restart, ask for something that was blocked, and reach IT, and where their answer comes back.

  • Software Center. Install software your IT team has published, or request titles that need approval.
  • Updates. See what is pending, install approved updates, and choose when to restart.
  • Requests. Ask for a blocked app, a USB device or a short elevation, with a reason, and track the answer.
  • Get help. Raise a ticket with IT from the app; replies show up as notifications.
  • Troubleshoot. Named checks with plain explanations, safe one-click fixes, and a send-to-IT button.
Download for Windows

Download

Get the app.
Pair it with a code from your IT team.

One installer for the desktop app and the agent. Administrators can also install the agent alone from a shell, on Windows or Linux.

UESP for Windows

Windows 10 and 11, 64-bit. Installs the desktop app and registers the agent as a Windows service that reports to your console.

  • The desktop app: Software Center, Updates, Requests, Get help and Troubleshoot.
  • The agent, registered as a LocalSystem service that starts at boot and restarts if it stops. Paired once with a 6-digit code.
  • No account to create. The pairing code comes from your IT team.
Download for Windows

After installing, open the app and enter the 6-digit pairing code your IT team gives you.

For administrators

Install the agent on its own from a shell. Run as an administrator or with sudo.

Windows (PowerShell)
iwr -UseBasicParsing https://api.allcyber.org/install.ps1 -OutFile $env:TEMP/uesp-install.ps1; powershell -ExecutionPolicy Bypass -File $env:TEMP/uesp-install.ps1
Linux
curl -fsSL https://api.allcyber.org/install.sh | sudo sh

Installs the agent and waits for a pairing code. On Windows it is registered as a service that starts at boot.

Codes are issued from Add devices in the console.