Business antivirus that stops malware without stopping the business

Contents

1. 1Executive summary
2. 2The challenge
3. 3Architecture
4. 4How it works
5. 5Capabilities in detail
6. 6Security and data handling
7. 7Where it fits
8. 8Deployment and system requirements
9. 9Technical specifications
10. 10Getting started

1Executive summary

ThreatGuard runs on the same TotalHeal agent as your other products. It blocks known malware with layered detection, quarantines only confident verdicts automatically and puts every quarantine, restore and exclusion on record — because an antivirus that quarantines legitimate work soon gets switched off.

2The challenge

Every organisation still has to stop known malware on its laptops and desktops, and tenders buy antivirus as its own line. An antivirus that quarantines developers’ projects or business files soon gets switched off.

The TotalHeal approach. Endpoint protection on the same TotalHeal agent as your other products, steered from the console, with every quarantine, restore and exclusion on record.

3Architecture

4How it works

1. ArriveA file lands in Downloads, Desktop, Documents, a folder you add or a USB drive.
2. CheckSigned definitions, YARA rules, archive inspection and heuristics on the device; cloud reputation for unknown files.
3. DecideConfident verdicts are quarantined; heuristic findings wait for a person.
4. ReviewEvery detection across devices in one list, with restore and delete from the console.

5Capabilities in detail

• Layered detectionKnown-bad files from signed threat definitions, YARA rules, archive inspection, static heuristics and cloud reputation for files the device has never seen.
• Real-time protectionFiles arriving in Downloads, Desktop, Documents, folders you add and USB drives are checked as soon as they finish writing.
• Built against false positivesOnly confident verdicts are quarantined automatically; heuristic findings wait for a person. Rules only count on the kind of file they were written for, and common developer folders are excluded by default — visibly, and removable.
• Quick, full and custom scansOn the device or sent from the console, with pause, resume and cancel.
• Safe quarantine and restoreQuarantined files are kept encrypted and can be put back exactly as they were. A restore never overwrites a newer file.
• Works offlineProtection keeps running with the last installed definitions when the device is offline; definitions are verified before they are used.
• Central policyReal-time protection on or off, quarantine or report on detection, and scheduled scans — set once for the organisation.
• Central quarantine and detectionsEvery detection across devices in one list; restore or delete quarantined files from the console, with an audit trail.
• USB control and Ransomware Shield (Enterprise)Scan drives on insert and eject untrusted ones; ransomware activity in protected folders is detected and raised as an alert.
• Approved exclusions and per-group policy (Enterprise)Every exclusion carries a reason and a second person’s approval; different policies and scan schedules per device group.
• Its own licenceAn expired ThreatGuard licence pauses only antivirus, with a clear message on the device; other TotalHeal products keep running and restores always work.

6Security and data handling

• Restores are exactQuarantined files are kept encrypted and put back exactly as they were; a restore never overwrites a newer file.
• Exclusions are approvedEach exclusion carries a reason and, on Enterprise, a second person’s approval.
• Definitions are verifiedDefinitions are signed and checked before use; protection keeps working offline.

7Where it fits

8Deployment and system requirements

9Technical specifications

10Getting started

• TotalHeal desktop agent enrolled to your organisation on each endpoint
• macOS: Full Disk Access for TotalHeal (by the person or your MDM)
• Outbound HTTPS to the TotalHeal cloud for definitions, reputation and policy

Start a 30 days trial in the TotalHeal console with a Sttiz account. For a quote, an on-premises installation or the procurement dossier (compliance matrix, bill of materials, architecture and hardening, SLA, OEM authorisation letter), write to business@totalhealsecurity.com.