Questions & Answers.

The most common questions our customers ask.

  • A SIEM correlates logs against rules you write. Qato learns behavioral baselines per host and flags deviations you didn't anticipate. They complement each other — Qato catches what your rules don't cover, and it can be configured to forward its detections and anomaly data to your SIEM for centralized visibility.

  • Network connections, process activity, listening ports, file access, authentication events, protocol usage, and more. Each facet is baselined independently per host with separate profiles for business hours, off-hours, and weekends.

  • It starts collecting immediately. Baselines become reliable after 7 to 30 days depending on the host's activity level. Time-aware profiling means weekday patterns don't pollute weekend baselines even during the learning period.

  • Yes. It ships as a self-contained offline package. No cloud dependency, no call-home requirement. All components run inside the enclave: server, agents, and database.

  • FIPS 140-3 compliant cryptography via OpenSSL FIPS Provider, RBAC with OIDC/SAML/LDAP integration, mutual TLS between agents and server, and full audit logging of all administrative actions.

Qato is still evolving...‍

As we continue to develop the solution for our customers we are always thinking about ways to expand the work already completed. Our roadmap includes some interesting items that will continue to expand anomaly detection into new areas. Feel free to schedule a call to discuss the questions above or to discuss where we are headed.

Get Started