What if Internet connectivity is lost?

Internet connectivity & optimal protection

As long as a device has Internet access, protection is complete and real-time. The agent communicates continuously with the Cloud to leverage the platform's global threat intelligence and enable centralized detection and response.

Temporarily offline device (travel, dead zone, etc.)

A device without internet connection remains protected.

• Local ML models : The agent embeds on-sensor Machine Learning models, allowing it to autonomously detect and block threats (e.g. malware from a USB drive) without any cloud connectivity.

• No EDR capabilities : Real-time telemetry, threat hunting, and remote response actions from the console are unavailable until the device reconnects.

As soon as the device reconnects, all locally recorded telemetry from the offline period is immediately uploaded to the console for retrospective analysis.

Private or isolated networks (Air-gap)

The following network flows must be opened at the firewall. Each platform has a list of domains and IPs to whitelist:

• CrowdStrike

• SentinelOne