Vedric correlates archive and replication process metadata, removable-media writes, temporal drift, sensitive-extension inventory changes, and host-level network aggregates. These signals can justify a review. They do not prove which content moved.
Currently supports Windows endpoints.
Network-egress alerts show that bytes moved, but not necessarily why. Process and command drift, unusual archive-tool use, removable-media writes, and after-hours activity can make that signal more useful. Vedric correlates this metadata. Content classification and per-file read evidence are left to DLP or EDR products that actually collect them.
Match on file content and patterns. They miss data when staged files contain no regex-recognizable secret, when the format has been changed, or when data moves in chunks below the rule threshold.
Shows the bytes leaving. Good for forensics, weak for prevention. By the time NetFlow shows the spike, the actor has already made the egress decision.
Sees compression and copy events but does not connect them to scope drift, temporal drift, or privilege drift on the same identity. Per-event detection does not show the pattern.
Monitors sanctioned cloud services. Misses on-premises staging, USB transfers, encrypted transport, and use of sanctioned cloud services that is unusual for this user.
Vedric correlates supported metadata: temporal drift, archive and replication tool use, removable-media write counts and bytes, sensitive-extension inventory changes, and host-level anomalies in outbound bytes and new-destination counts. Analysts still determine intent and content sensitivity.
First-time use of archive or replication utilities, command-line drift, removable-media writes, and sensitive-extension inventory changes can add staging context. Vedric does not observe bulk reads or repository-level file access.
Command-scope drift in week one, temporal drift in week two, and drift in host-level outbound bytes or new-destination counts in week three can be correlated on the same endpoint and identity where attribution evidence exists.
Confidence can rise when drift in host-level outbound bytes or new-destination counts correlates with supported precursor metadata. Evidence stays labeled by collector, so an analyst can see what was and was not observed.
A senior researcher is leaving the company in two weeks. They have legitimate access to everything they want to take. None of the individual events would trigger DLP.
The correlated metadata justified an investigation before offboarding. It did not establish which files moved. The analyst would combine it with authorized DLP, storage, or forensic evidence before making that claim.
Vedric is designed to minimize content collection. The agent code enforces the list of refused collectors and the documented, bounded PowerShell exception.
Read the full privacy stanceEarly access is for security teams that want to monitor exfiltration as a pattern, well before the data has left.