Skip to content

FreeDR feature list

Every feature present in FreeDR as of main fcfd49b (2026-10-15), grouped by area. Each area links to its wiki section. Items marked partial are implemented but not fully qualified.

Sections: Getting started · Data sources · Configuration · Rules · Alerts & Cases · AI features · Miscellaneous

Installation

  • Single-file FreeDR-Setup.exe with the agent, tray and DuckDB runtime built in; asks for administrator elevation; x64 Windows 10 and 11 (Home, Pro, Enterprise, Education).
  • Native setup wizard: Welcome (optional config-file import), password, AI investigator, threat-intel keys, progress, Finish (opens the console as the normal, non-elevated user).
  • AI set up during install: provider (CheaperInference, OpenAI, Anthropic, DeepSeek), model, thinking level, API key, AI containment, web research, daily token limit.
  • Threat-intel keys set up during install: abuse.ch, AbuseIPDB, VirusTotal, AlienVault OTX, GreyNoise.
  • Rule exclusions applied during install from the config file.
  • Settings applied through the same local API as the Settings page (same validation, encrypted key storage and audit); secrets sent only to the verified FreeDR service.
  • Unattended install: /config <file.json> or /unattended, password from standard input, exit codes 0–3.
  • Strict JSON config file (schema_version 1, unknown fields rejected, everything validated before install).
  • Existing-data reuse: setup asks for the old data's password and keeps alerts, cases, settings and evidence.
  • An already-installed service is detected; setup offers to uninstall it instead (no in-place upgrade).
  • Sysmon handling: an existing Sysmon is left untouched; a missing one is downloaded from Microsoft, hash-checked and installed with FreeDR's config.
  • Alternative install by running freedr-agent.exe directly (console password prompt or --password-stdin).
  • Protected data folder C:\ProgramData\FreeDR (SYSTEM and Administrators only).
  • Auto-start Windows service with limited crash-restart recovery.
  • Local console at http://127.0.0.1:29173/ (loopback only), password sign-in, 12-hour sessions, 5 failed logins per minute.
  • Tray app: status icon (OK, alerts, degraded, isolated), open console, Windows alert notifications, relaunched if it crashes.
  • Upgrade by uninstalling with Keep FreeDR data, then running the new setup (no in-place upgrade over a running install).
  • Uninstall from FreeDR-Setup.exe (wizard or /uninstall [/keep-data]), protected by the FreeDR password: removes the service and tray, lifts FreeDR traffic blocks and host isolation, deletes FreeDR's files or keeps its data. Sysmon stays installed.
  • freedrctl CLI (built from source, not shipped in setup): status, version, alerts, rules, detection health, service start/stop/status/uninstall.

Configuration

  • Optional freedr.toml read at service start: API port, hot retention, ETW decode worker counts, artifact request queue size; loopback-only bind; strict validation.
  • FREEDR_* environment-variable overrides for freedr.toml settings.
  • Optional telemetry filter policy (config\telemetry-filters.toml) replacing the built-in Microsoft-noise filters.
  • Evidence retention in Settings › Storage (default 90 days, 1–3650; confirmation to shorten).
  • Storage panel: hot age, hot and write-ahead-log size, cold file count and size, free disk space.
  • Sources settings: live green/amber/red/grey status for optional Windows sources (events seen in the last 24 hours).
  • One-click Enable, Disable and Restore for audit policies, PowerShell script block logging and event channels, with dependency enabling and an audit history.
  • Sysmon install from Settings › Sources.
  • Defender real-time protection, Tamper Protection and Defender channel reported read-only.
  • Alert raised when a telemetry source is turned off from the console.
  • Threat-intel provider switches and daily lookup limits (default off, 100/day; VirusTotal ≤ 500/day), with an access check that sends no case evidence.
  • Write-only provider API keys, encrypted with Windows DPAPI.
  • AI investigator settings (provider, model, thinking, enable, token limit, AI containment, web research).
  • Password change (≥ 12 characters, signs out all sessions) and sign-out.
  • Windows alert notifications (default off, minimum severity High, rate-limited, informational never notifies).
  • Browser-only appearance settings: time zone, time display, density, rows per page, auto-refresh.
  • Read-only Collection, Detection and About & status panels.

Data sources

  • Process ETW: process start and exit with command line, user SID and name, parent and grandparent lineage; executable image loads.
  • Full image path on each process start (NT device paths converted to drive letters).
  • Startup rundown records processes and images already running (is_rundown).
  • Registry ETW: key create/delete, value set/delete with exact value data, key security changes.
  • Registry path resolution from kernel key objects; identical changes merged within 500 ms.
  • Registry noise filters: FreeDR's own keys, component servicing, app hives, Edge Update progress, FeatureManagement.
  • COM CLSID/Interface/AppID display names in the console (live lookup).
  • File ETW: completed creates (with created flag), writes, renames, deletes and metadata changes.
  • File events attributed to processes via shared thread history (2 s hold, one OS check, no held handles).
  • File first-only dedupe per process, operation and path once per 60 s.
  • Measured file and USN noise exclusions, plus filters for FreeDR's own I/O and Defender definition reads.
  • USN change journal on up to 32 fixed NTFS volumes, durable per-volume cursor, gap detection.
  • USN path resolution by file ID with parent-directory fallback; first-only per file and reason per 60 s.
  • Artifact inventory: SHA-256, size, timestamps, NTFS file ID, PE header values, alternate data streams.
  • Offline Authenticode verdict and signer (including catalog signatures), no network calls.
  • Artifacts collected on first sight and again only on content change; files over 500 MiB recorded without hash.
  • Targeted artifact acquisition from Live MFT Hunt and case enrichment.
  • Windows Event Log: 19 channels, 124 event types (Security, System, Defender, Task Scheduler, PowerShell 4104, RDP, WinRM, WMI, Firewall, AppLocker, Code Integrity, MSI, BITS, PnP, VHDMP, Sysmon).
  • Event Log bookmarks per channel; log-clear replay for Security and System; coverage-gap counting.
  • event_log Hunt relation exposing every named Windows event field.
  • Acting process (actor_*) attached to Event Log rows.
  • Sysmon auto-install with FreeDR's configuration (pinned hash; an existing Sysmon is never changed).
  • Sysmon self-exclusion in the config and at ingestion.

Storage & health

  • Local hot DuckDB evidence store with a single ordered, set-based writer.
  • Deterministic event_id on every row; replays are not stored twice.
  • Source cursors (USN, Event Log) committed in the same transaction as the evidence.
  • Hot retention (default and minimum 45 min) followed by verified cold Parquet (ZSTD) export.
  • Final expiry by retention_days (default 90, editable in Settings).
  • Hunt queries hot and cold data together; detection rules read hot data.
  • Unified events view across all six sources, plus event_log.
  • In-process recovery: an invalidated database is reopened without a service restart.
  • ETW raw rings that grow 16 → 256 MiB, wait instead of dropping, and shrink when quiet.
  • DuckDB isolated in a private Windows heap.
  • Health per collector with counters and gauges; degraded held 30 minutes with episode counts and last-fault time.
  • Storage diagnostics: rows per table, hot/WAL/cold size, free disk space, control DB integrity.
  • Event flow chart of ingest volume per source (1 h / 24 h).

Rules & detection

  • 345 built-in Windows rules compiled into the agent (pack core-windows v0.3.0): 7 critical, 200 high, 94 medium, 42 low, 2 informational.
  • Rules categorized by ATT&CK tactic (13 categories incl. malware); 333 rules map to 178 technique IDs, shown in a Coverage view.
  • Rules mostly translated from public Sigma content (SigmaHQ, mdecrevoisier, Hayabusa, Elastic, Splunk, Velociraptor), with provenance headers.
  • Rules are DuckDB SQL over six typed sources: process, registry, file, USN, artifact, Windows Event Log.
  • Two rule kinds: one alert per matching event, or threshold (one alert per run when ≥ N events match).
  • Three schedules: P1/P2/P3 every 2, 8 or 15 minutes, each reading only events ingested since its last successful run.
  • Constant run cost over uptime: rules read only hot data; history reads limited to the rule's timeframe.
  • Rules may read time-limited history from their own and other typed sources and the latest facts per file path.
  • Strict SQL validation: one SELECT, no CTEs/joins/table functions, bounded INTERVAL, exact output-column contract.
  • Slow runs retried with a doubling time budget; failed runs back off and keep their position.
  • Run history and detection health API (run totals, degraded, late runs, lagging rules, control-store integrity, case automation).
  • Enable or disable any rule, individually or in bulk.
  • Custom rules: create, edit, validate, test against the last 24 h or 7 days, versioned history with restore (disable instead of delete).
  • AI can draft a custom rule or Hunt SQL from a plain-language description (advisory).
  • Alert text templates with {{placeholders}} (literal insertion, control-character check, 4 KiB limit).
  • Built-in exclusions shipped with rules.
  • Per-rule user exclusions (≤ 1024 bytes, ≤ 16 per rule).
  • Exclusion builder from a false-positive alert's fields, with a 7-day preview of what it would suppress.
  • AI-proposed exclusions stay pending until the owner approves or rejects them.
  • Time-boxed mutes (24 h or 7 days) for a rule or one entity; muted alerts stored but create no case, AI run or notification.
  • Append-only tuning audit of every exclusion and mute change.

Alerts & cases

  • Alert identity derived from rule, rule version and event; no duplicate alerts per rule version and event.
  • Alert list with filters (rule, text, case, severity, confidence, assignment, triage, time range, urgent unresolved) and a grouped view.
  • Alert triage (new, investigating, resolved as true positive / expected activity / false positive) with history; bulk triage up to 2,000 alerts.
  • Per-alert event timeline and on-demand AI explanation.
  • Automatic case creation for every alert except informational, muted or manually removed ones.
  • Evidence-based grouping: same event, same verified process instance, verified parent/child, or a same-rule burst from a startup-snapshot writer; PID reuse checked.
  • Automatic merging of compatible open cases; suggestions instead when grouping is blocked (closed case, correlation lock, manual separation, active response job, conflicting assessments).
  • Automatic reopening of a closed malicious case on related new activity.
  • Every grouping decision recorded with reason and evidence.
  • Manual case work: create, add/remove alerts, attach/pin events, merge, split, correlation lock, reopen.
  • Case status workflow (open, in progress, resolved, closed, merged), assessment, conclusion with outcome and closure reason; resolving requires the outcome and conclusion, in the console and the API.
  • Case severity follows the most severe alert; a malicious case escalates to critical on the next alert.
  • Findings, notes, activity feed and append-only case audit.
  • Automatic AI investigation of open critical/high/medium cases; AI auto-resolution on a benign verdict or verified containment.
  • Automatic enrichment per case event: file hash, signature (incl. Store/MSIX), hash/IP/domain reputation through enabled providers; manual requests too.
  • Deterministic case summary, process tree and downloadable HTML case report.
  • Tray alert balloons (severity threshold, burst collapse), icon state and health balloons (native qualification pending).
  • No delete for alerts, cases or custom rules; retention removes only closed or merged cases older than retention_days.

AI

  • Optional AI investigator (off until configured); one provider chosen in Settings or the setup wizard.
  • Providers and default models: CheaperInference deepseek-v4.1-flash (default), OpenAI gpt-6.1-sol, Anthropic claude-sonnet-5-5, DeepSeek deepseek-flash; model ID editable; fixed HTTPS endpoints.
  • Per-provider thinking levels: CheaperInference and OpenAI none…max (default medium); Anthropic disabled, between_tools, low…max (default medium); DeepSeek disabled, low, high, max (default high).
  • Separate write-only, DPAPI-encrypted API key per provider.
  • Token accounting: daily cap (400k–20M tokens), per-run reservation, 3 investigations and 2 assists at once, 30 rounds / 100 tool observations per run, usage shown per run.
  • Automatic case investigation for open Medium/High/Critical cases; never-investigated first; re-run when evidence changes.
  • Manual investigation of any case, follow-up sessions, stop/cancel.
  • Investigator tools: case_context, query (read-only DuckDB), investigate_step, enrich, inspect_response, propose_exclusion, read_observation, finish, plus web_search and read_public_page when web research is on.
  • Benign verdict resolves the case and its open alerts as expected activity.
  • AI containment (off by default; the owner turns on Let AI contain threats it finds): terminate, quarantine, remediate persistence, block traffic — only on targets the case evidence cites, checked by the response service. Host isolation, permanent deletion, restores and exclusion approval stay with the owner.
  • AI-filed pending exclusions; only the owner approves.
  • Explain this alert (cached, regenerable; risk flags cap the verdict; unsafe next steps removed).
  • AI drafts: exclusion field choice, Hunt SQL (validated, runs only on Run), custom rules (validated, never saved by AI).
  • Public web research for the AI and manually from a case (anonymous search), with query/URL guards and per-run limits.
  • Guardrails: evidence treated as untrusted data, citations required, egress redaction, reasoning never stored, fixed tool list.
  • Search page: query and builder modes, histogram, CSV export up to 100,000 events.
  • SQL Hunt: read-only DuckDB SQL over events (56 columns) and event_log (named Event Log fields), hot and cold data.
  • Validate without scanning, CSV/NDJSON export (100,000 rows / 64 MiB), 1,000-row interactive limit, cancellable.
  • Saved query library with favourites.

Response

  • Terminate exact processes.
  • Quarantine to an encrypted vault, and restore.
  • Permanent file deletion.
  • Remove and restore persistence.
  • Block and unblock traffic (WFP).
  • Isolate and release the host.
  • Every action tied to a case and its evidence; plans up to 32 steps; protected targets; audit trail; "needs attention" after a restart.

Security, UI & health

  • Local-only API on 127.0.0.1:29173 with exact Host/Origin checks.
  • Single installation password (Argon2id), 12-hour sessions, login rate limit, CSRF token on every change.
  • User-mode tamper resistance (partial).
  • Data stays local; outbound traffic only for opt-in features (and the Sysmon download at install).
  • Health endpoints /live, /ready, /version, /status; component counters; 30-minute degraded hold; detection health; storage diagnostics; event flow.
  • Health page and freedr-health.json export.
  • Console pages: Overview, Alerts, tuning and mutes, Search, SQL Hunt, Alert rules and custom rule editor, Cases (all tabs, process tree, HTML report), Settings, Health.