Local behavioral analysis engine optimization

Datto EDR is optimizing the local behavioral analysis engine so more detections can be processed directly on the endpoint, with less reliance on cloud processing. This helps rules trigger in near real-time and improves responsiveness during active threats.

With this update, local processing performance increases from roughly 700 to 19,000 events per second, allowing more detection rules and automated responses to run on-device. New customer-created detection rules will default to using local detection, while Datto’s Detection Engineering team will decide which internal rules are enabled locally.

For your team, this means faster detection and action on busy endpoints, quicker containment for script and behavior-based attacks and less delay caused by cloud round-trips — especially when every second counts.

Learn more about local behavioral analysis engine optimization for Datto EDR here.