How the Security (EDR/XDR) Add-on Works

What Security gives you

Security is Plenix's endpoint detection & response (EDR), extended detection & response (XDR), and host-based firewall add-on — real-time and on-demand malware scanning, incident detection and triage, quarantine, host firewall rules, and beaconing/C2 detection, running on Windows, macOS, and Linux endpoints managed by the Plenix agent.

It is a separate module from EDR / Antivirus Management (the integrated third-party vendor view under Monitoring) — Security is Plenix's own detection engine running directly on the agent, not a dashboard for someone else's product.

Availability & pricing

Security is available as a paid per-device add-on on the Business (£1.50/device/month) and Enterprise (£1.00/device/month) plans. It is billed monthly based on however many devices are enrolled on the 1st of the month — there is no partial-month proration, so enrolling mid-month means the first bill covers a full month regardless of when in the month you enrolled.

Starter and Professional cannot purchase Security — upgrade to Business or Enterprise first.

Security is off by default

Unlike most modules, Security does not protect every device on your plan automatically. Nothing is scanned, monitored, or billed until you explicitly enroll:

• Enroll a customer/site — every current and future device under that customer is protected.
• Enroll an individual device — just that one device.

Device-level enrollment always takes priority over customer-level enrollment for that specific device — so you can enroll a whole customer and still opt a specific device out, or enroll a whole customer and add one extra device from an otherwise-unenrolled customer.

Unenroll a customer or device at any time to stop protection (and billing) for it — the change takes effect immediately, and the following month's bill only counts whatever is still enrolled.

Incidents

When the agent detects something — malware, a suspicious process, an unexpected outbound connection — it raises an incident. Each incident has a timeline of everything that happened (detection, containment actions, notes) and a status you can update as you work it (open, investigating, contained, resolved).

Policies & exclusions

Policies define scan behaviour (real-time vs on-demand, scan schedule, engine settings) and can be assigned to specific devices or groups. Exclusions let you whitelist a known-safe file, path, or process so it's never flagged or quarantined — useful for line-of-business software that behaves unusually. Exclusions can require approval before taking effect, so one technician can't silently create a blind spot.

Quarantine

A file the agent isolates as a threat goes into quarantine — an encrypted vault on the endpoint, not deleted. From the Security area you can review quarantined items and either restore a false positive back to its original location, or delete it permanently.

Host firewall

Security includes host-based firewall rule management — push a declarative rule set (allow/block by port, protocol, or destination) to enrolled devices, enforced by the local OS firewall (Windows Defender Firewall, nftables on Linux, pf on macOS).

Where to go next

• Plans & Pricing — confirm Security is available on your plan
• EDR / Antivirus Management — the separate third-party-vendor integration view