Runtime detection
Catch the attack while it is happening.
A kernel-level sensor on every Linux host and Kubernetes node sees every process, file and connection. orta scores each event and raises only the few that matter.
How runtime security works, end to endSees what runs
Process starts, file access, network connections and DNS, captured with eBPF on Linux and ETW on Windows.
Scores every event
Rules mapped to MITRE ATT&CK score each event from 0 to 100. Only real risk becomes an alert.
Shows the whole story
Every alert carries the process tree, a timeline and the commands typed in the session.
AI triage of your alerts
Within your plan's hourly limit, each alert is triaged automatically from its process tree, network and threat intel evidence: a verdict with confidence, the attack narrative, MITRE mapping and what to do next.
Repeat noise stays quiet
Once an alert class is judged a false positive, repeats are suppressed for a day. Critical alerts are always analysed.
Blocks when you choose
Any policy can run in enforce mode and stop the process in the kernel.
Resists tampering
If someone removes a policy on a host, orta restores it and raises an alert.
Works with what you run.
Runs on
- Ubuntu
- Debian
- Red Hat
- Rocky Linux
- AlmaLinux
- Fedora
- Windows
- Kubernetes
Alerts go to
- Slack
- Telegram
- Jira
- Signed webhooks