Detection and monitoring EU-developed
Stormshield Endpoint Security Evolution
Endpoint detection and response software for workstations and servers, with behavioral detection, YARA-based hunting and predefined or custom remediation actions.
By Stormshield · France
The record identifies an EU developer or development origin. The origin note explains the evidence; current ownership and hosting are recorded separately where established.
At a glance
Recorded facts- Response workflow
- Detection and monitoring
- Developer or maintainer
- Stormshield
- Recorded country
- France
- Product model
- Commercial
- Deployment
- Self-hosted / SaaS
- Software license
- Commercial license; full terms not publicly verified
- Upstream status
- Active
- Evidence class
- EU-developed
What the sources establish
Origin noteStormshield states that all of its R&D teams and product development are in France; it identifies Airbus Defence and Space Cyber Programmes as owner.
Reported capabilities
- Detects and blocks suspicious endpoint activity with a local agent.
- Supports YARA hunting, IOC searches and incident-remediation actions.
- Available as on-premises software or SaaS.
Scope and limits
Stormshield's general sales terms reserve rights in its software but defer product-specific grants to separate contracts; SES Evolution's full customer license was not publicly verified.
Inspect the research evidence 4 source observations
identity / capabilities / deployment
Vendor product page names SES Evolution, describes behavioral detection, YARA/IoC search and remediation, and offers on-premises and SaaS deployments.
Read sourceorigin / country
Stormshield says all its R&D and development are carried out in France, lists Endpoint Security Evolution, and identifies its Airbus Defence and Space Cyber Programmes parent.
Read sourcelicense
General product terms state Stormshield retains IP in its software and customer rights are defined by a separate license contract; SES Evolution's complete grant was not published on this page.
Read sourcemaintenance
Stormshield publishes a 2026 lifecycle guide for the current SES Evolution product line, evidencing ongoing version support.
Read source
This profile summarizes source material. It does not include hands-on security testing, procurement review, or an assessment of fit for your environment.
Capabilities & integrations
Tags record specific documented functions. They do not establish end-to-end interoperability; check the component, edition and version in the source.
No structured capability or integration evidence has been added for this tool in the current pass. This does not establish that a feature is unsupported. Send a documentation link.
Put the tool in context.
Check telemetry, field mappings, conversion and alert handling before deploying a Sigma rule. A practical detection workflow for CSIRTs and SOC teams.
From Sigma rule to a tested detection