See What You Can Build
Heathen EDR is a working endpoint detection and response product built entirely on the Heathen telemetry SDK — no kernel code, no driver development. One developer. The same telemetry layer available to you.
Download Demo ↓What This Demo Demonstrates
Building an EDR means solving two fundamentally different problems: getting kernel telemetry and doing something useful with it. The Heathen SDK eliminates the first problem entirely. This demo is proof.
Every event you see in the dashboard — file creates, process starts, network flows, handle acquisitions, registry writes — comes through the same SDK headers and callback structs available in the dev kit. The detection rules, the alert pipeline, the web dashboard: all user-mode code written without touching a kernel debugger.
This is not a proof-of-concept. The kernel drivers are production-signed, pass Driver Verifier, and run on every supported Windows version from 10 1903 through the latest Windows 11. What you are installing is representative of production quality — the same artifacts a commercial licensee would ship to customers.
What Gets Installed
The MSI installs to C:\Program Files\Heathen\ and registers HeathenAgent as a Windows service. Configuration and the event database land in C:\ProgramData\Heathen\.
| Component | Type | What It Does |
|---|---|---|
| HeathenCNC.sys | Kernel | Ring buffer broker. Manages the shared memory channel between the kernel drivers and HeathenAgent. All events flow through here. |
| HeathenEDR.sys | Kernel | Minifilter driver. Captures file system events: creates (new vs. existing), writes, renames, deletes, and attribute changes. |
| HeathenNetEDR.sys | Kernel | WFP callout driver. Captures network flows: TCP/UDP connections, DNS queries, TLS SNI, inbound and outbound with port and protocol. |
| HeathenAgent.exe | Service | Windows service. Consumes the ring buffer, runs detection rules, writes events to a local SQLite database, and serves the dashboard API. |
| HeathenDash | Service | Web dashboard (Flask). Real-time telemetry viewer and alert feed. Opens in your browser at localhost:5000. |
| HeathenConfig.exe | Tool | GUI configuration editor. Adjust monitoring scope, data retention, logging level, and process whitelist without hand-editing JSON. |
| HeathenStimulator.exe | Tool | Attack scenario generator. Fires detectable behaviors — shadow copy deletion, cross-process memory access, C2 pipe patterns, service installation — so you can watch the detection pipeline respond in real time. |
How to Use It
Installation requires administrator rights and a reboot is not required. The agent service starts automatically after install.
Open the dashboard.
Launch Heathen Dashboard from the Start Menu or the desktop shortcut. Your browser opens to localhost:5000. Live telemetry starts streaming immediately.
Fire scenarios.
Run Heathen Stimulator from the desktop. Select a scenario — VSS deletion, remote thread injection, suspicious pipe name — and watch the alert appear in the dashboard within seconds.
Tune the agent.
Open Heathen Config to adjust what the agent captures: toggle monitoring families on and off, set retention limits, configure the process whitelist, or point to a custom deny hash list.
To uninstall: msiexec /x HeathenEDR.msi /quiet or use Add/Remove Programs. The agent service and all three drivers are stopped and removed cleanly.
What You Need
Get the Demo
This is a demonstration build provided for evaluation purposes. Please read the terms below before downloading.
Evaluation License — Summary
You may install and run this software on machines you own or control, for the purpose of evaluating the Heathen telemetry SDK and the capabilities it enables. This build is provided free of charge.
You may not redistribute, repackage, or deploy this software to systems outside your organization. The included kernel driver binaries are production-signed by Heathen Software and may not be extracted or used independently.
No warranty is provided. This software is supplied as-is. Heathen Software is not liable for any damage arising from its use. Install only on systems where you have authorization to load kernel drivers.
This summary does not replace the full license terms. The complete Dev Kit License Agreement governs your use of this software.