Skip to main content
Malware is the finding source for malware-oriented behavior (Gatekeeper bypass, tampering, agent attacks). Three tabs: Queue, Rules, and Fleet. Rules requires the manage alerts permission.

Tab: Queue

Malware-category findings with severity, responsible application, and evidence.

Tab: Rules

Detection rules in the malware category, including built-in endpoint rules.

Tab: Fleet

Every endpoint’s malware status at a glance (macOS and Linux) — green when clean, red when a machine has findings. On-device rule families that feed this surface:
Last modified on October 8, 2026