# ET Ducky

> Cross-platform RMM with kernel-level diagnostics: Windows and Linux endpoints, AI root cause analysis, patch management with post-patch verification, behavioral security, and published pricing.

ET Ducky is a remote monitoring and management (RMM) platform for Windows and Linux endpoints, built on kernel-level telemetry (Event Tracing for Windows on Windows, eBPF on Linux). It correlates kernel events, health signals, and system changes directly on the endpoint, filters out PII before anything leaves the machine, and uses AI to deliver plain-language "what happened / why / what to do next" summaries. One agent, one dashboard, and one policy engine cover both operating systems. macOS and mobile devices are not supported.

## Core Capabilities

- **On-Agent Kernel Correlation Engine**: Captures and correlates kernel events locally (ETW on Windows, eBPF on Linux). Raw telemetry never leaves the endpoint; the correlation engine produces structured diagnostic summaries with a 99.6% bandwidth reduction versus raw event streams.
- **AI-Powered Root Cause Analysis**: Processes correlated kernel findings through AI to generate plain-language explanations of system issues, their causes, and recommended fixes.
- **Live Query Sessions**: Real-time interactive troubleshooting with individual agents: start kernel event collection, ask diagnostic questions in natural language, get AI-analyzed answers.
- **Anomaly-Triggered Diagnostics**: An inflection detector runs after every heartbeat; significant metric changes (CPU spikes, memory drops, disk queue jumps) automatically flush the buffered kernel-event window for correlation.
- **Remote Desktop**: Browser-based remote control of Windows and Linux hosts (Wayland portal or x11vnc on Linux), with H.264 over WebCodecs when available, integrated diagnostics, remote shell, and bidirectional file transfer.
- **Multi-Agent Analysis**: Query multiple agents simultaneously and run cross-correlation analysis across devices to trace distributed issues.
- **Alerts and Automations**: Rule-based alerting on health metrics with automated AI root cause analysis. An automation engine fires on 14 trigger types including alerts, security detections, agent enrollment/offline/online, ticket and script submissions, application installs and removals, app behavior deviations, approved-app hash mismatches, catalog app updates, schedules, and manual runs.
- **Fleet Management**: Centralized dashboard for agent deployment, tagging, health monitoring, configuration, workspaces, and team management.
- **Auto-Generated KB Documentation**: Record a procedure while the agent captures the kernel event stream; AI filters background noise and produces a Markdown KB article with numbered steps and hotkey-captured screenshots.
- **Ticketing**: Native ticket queue with one-click live sessions and attached diagnostics, plus bi-directional Jira and ServiceNow sync.
- **Desktop Application**: Free Windows 10/11 app for local ETW monitoring and interactive troubleshooting.

## Patch Management and Third-Party Software Catalog

- **Native cross-platform patching**: winget and Windows Update on Windows; apt, dnf, zypper, snap, and flatpak on Linux, all driven by a single policy engine with maintenance windows, deferral rules, and exclusions.
- **Staged ring rollouts with kernel-verified promotion**: New versions reach a canary ring first, soak for a configured window, and promote only if post-patch health checks pass. Verification draws on the kernel event stream: services back up, no crash loops, no baseline deviation, no behavioral rule firings. Regressions pause the wave and roll back automatically where the package manager supports it.
- **AI-assisted third-party app search**: The Software Catalog includes a search box that finds any third-party application by name. It searches the public winget catalog and the organization's Linux fleet inventory first; for apps neither tracks, an AI web search locates the official vendor download, version, and metadata. AI-resolved entries land in a needs-review state and cannot deploy until verified (fail-closed). Bulk actions match name-only entries to package managers without AI, or resolve the remainder with AI.
- **AI-drafted install scripts**: Each catalog entry can generate an install script (template or AI mode) that flows through the script approval pipeline before it can run.
- **Fail-closed installer verification**: Downloaded installers are checked for EV code-signing (Authenticode) and a SHA-256 match anchored in the version manifest; failures delete the file and abort.
- **Version tracking**: Catalog entries track vendor releases, and the catalog_version_update automation trigger fires when a new version of a tracked app is detected.

## Security

- **Behavioral detection engine**: Fifteen built-in rules run on both operating systems against the kernel event stream, including mass file access, mass file rename to ransom extensions, ransom-note patterns, shadow copy/backup deletion, suspicious exec chains, reverse-shell heuristics, privilege escalation from non-interactive parents, unusual outbound from system daemons, a crypto-miner heuristic, and a ransomware kill-chain meta-rule that fires when two or more components co-occur within five minutes. High-confidence ransomware detections trigger automatic network isolation.
- **Fleet behavioral baselines**: The cloud learns a per-application behavioral profile from the organization's own fleet (15-minute rollups) and flags hosts where an app behaves as an outlier. Ships default-off with a shadow mode for tuning.
- **Approved-app binary integrity**: Agents report a SHA-256 of each approved application's primary binary (Windows, and Linux rpm/dpkg via on-disk self-hashing). The cloud keeps a per-organization hash ledger with trust-on-first-use: the reference is elected by agent majority, and any later divergent hash for the same app/version/architecture raises a detection exactly once. Catches tampered, repackaged, or swapped binaries. Default-off with shadow mode; references never cross organizations.
- **Security posture in heartbeat**: Defender status and definition age, firewall state, BitLocker, UAC, and Secure Boot, queryable in reports.
- **Isolation and recovery**: Auto-isolation blocks all traffic except the management channel; de-isolation requires dual approval (dashboard operator plus the logged-in user).

## Reporting and Data

- **Smart Reports**: Natural-language questions ("apps flagged for wrong hashes in the last 30 days") are planned against org-scoped datasets and rendered as charts and tables.
- **Data Explorer**: Direct queries over behavioral detections, the binary-hash ledger, fleet baseline profiles and observations, anomaly inflections, observed indicators of compromise, org-wide application inventory, application install/remove/upgrade history, and health/hardware metrics.
- **Data retention**: 14 days free for all organizations; add-ons per agent per month: 90 days at $0.50, 365 days at $1.50, 730 days at $2.50.

## Distribution Servers

An agent can act as a LAN-local file hub serving a mountable WebDAV/HTTPS share for arbitrary organization files, governed from the cloud: per-path per-principal access control (list/read/write/delete for everyone, a role, or one user), opaque revocable mount keys (salted-hashed at rest), and data residency by design: file bytes move directly between clients and the hub on customer infrastructure and never traverse the ET Ducky cloud. Optional WAN reach via STUN/UPnP/port-forward.

## Time Tracking and PSA Billing

- **Time entries** come from a start/stop timer, manual entry, or auto-capture: finishing a live session, remote desktop session, shell session, or file transfer automatically creates a draft entry attributed to the technician who ran it, so time writes itself from session telemetry.
- **Classification automations** flag captured entries billable, non-billable, or logging-only by source, technician, agent, or duration.
- **Weekly timesheets** (Monday-Sunday) with submit and approve/reject workflow. Approval snapshots each entry's hourly rate, so later rate changes never alter past invoices. Rates are per member per organization.
- **Granular roles**, granted per organization by a workspace owner only (admin does not imply them): timesheet_approver (approve timesheets, set rates, run reports and CSV export, query the time dataset in Smart Reports) and billing_approver (generate invoice drafts).
- **Stripe draft invoicing**: a billing approver turns approved billable time into ONE draft invoice (hours x rate per category, idempotent) in the organization's OWN Stripe account via a restricted API key the org provides. Payments flow directly to the MSP. This is entirely separate from ET Ducky's own subscription billing: no shared account and no Stripe Connect relationship. ET Ducky never finalizes, sends, or charges invoices.
- **Generic signed webhook**: pushes time and billing events (time_entry.approved, timesheet.submitted, timesheet.approved, time_entry.captured, billing.invoice_drafted) to any endpoint, HMAC-SHA256 signed, for Zapier/Make or any PSA middleware.
- **Scope**: this is a time-to-invoice pipeline, not a full PSA replacement. No tax handling, contract management, AR aging, or accounting sync; bi-directional Jira/ServiceNow sync covers full service-desk workflows.

## Platform Support

- **Windows**: Windows 10/11, Windows Server 2016+. Agent runs as a Windows service; kernel events via ETW.
- **Linux**: Packages for .deb (Debian/Ubuntu), .rpm (RHEL/Fedora/SUSE), and a universal .run installer. Agent runs as a hardened systemd unit under an unprivileged user; kernel events via eBPF; commands that need root run through Run as root, which needs an owner or a granted privilege and a host opt-in file, with an audit entry per command.
- **Not supported**: macOS, iOS, Android.

## Deployment Options

- **Cloud Hosted (Shared)**: Multi-tenant, managed by ET Ducky. Included with all subscriptions.
- **Cloud Hosted (Dedicated)**: Single-tenant dedicated infrastructure, tiered for 100-999, 1,000-4,999, and 5,000-9,999 agents.
- **Local-First (Self-Hosted)**: The whole platform runs on your own infrastructure as Docker images, with unlimited seats and technicians at one flat price ($650 a month, or $552.50 a month billed annually). It isn't completely air-gapped, but only sign-in and license renewal need outbound HTTPS.

## Pricing

Published at https://etducky.com/pricing. Every feature is available at every paid tier; tiers differ in AI query allowance.

| Plan | Price | AI Queries/Month | Best For |
|------|-------|-------------------|----------|
| Free query tier | $0/mo | BYOK (bring your own key: Anthropic, OpenAI, or Azure OpenAI) | Individual developers and power users |
| Professional | $39/mo | 1,000 | IT professionals and small teams |
| Business | $99/mo | 5,000 | Growing teams |
| Enterprise | $249/mo | 50,000 | Large fleets |

- **Agent seats**: Billing is per agent. Every query subscription includes 20 agent seats at no extra cost, and query subscriptions are optional. Additional agents $5/agent/month (up to 99 agents), $4 (100-999), $3 (1,000-9,999), $2 (10,000+). Desktop app usage is free and unlimited.
- **Organization quota pooling**: each query subscription's allowance and its 20 included agent seats pool across the organization, and users can join without their own subscription (example: 2 Professional subscriptions = 2,000 queries and 40 included agent seats).
- **Annual billing**: saves 15% on all recurring costs.
- **No setup or onboarding fees.**

## Data Privacy and Residency

- PII filtering and proprietary-data scrubbing happen on the endpoint before anything reaches the cloud.
- All ET Ducky infrastructure is hosted in DigitalOcean US regions; stored data does not leave the United States.
- AI processing routes to Anthropic by default; BYOK lets organizations point AI features at their own provider (including Azure OpenAI regional endpoints) for jurisdictional control.
- Tenant isolation via row-level security; one organization's data never influences another's detections or baselines.

## Compliance and Security Review

ET Ducky holds no SOC 2 report, no ISO 27001 certification, no FedRAMP authorization and no StateRAMP or GovRAMP authorization. SOC 2 readiness work is in progress. The security whitepaper maps controls to the SOC 2 Trust Services Criteria, ISO 27001 Annex A, NIST CSF and GDPR Article 32; that mapping is a vendor self-assessment, not an attestation. All six sub-processors (Clerk, Stripe, Anthropic, SendGrid, DigitalOcean, Cloudflare) hold current attestations. Cloud infrastructure runs in United States regions only; the sole cross-border path is a user-initiated AI analysis call to Anthropic's API, which can be disabled or run self-hosted.

- [Compliance overview](https://etducky.com/compliance): attestation status, available documentation, and where an endpoint agent fits in a control program.
- [Cyber insurance endpoint controls](https://etducky.com/compliance/cyber-insurance-controls): application and renewal questions answered with the specific mechanism, including the limits.
- [HIPAA endpoint controls](https://etducky.com/compliance/hipaa-endpoint-controls): 164.312(b) audit controls, 164.308(a)(1)(ii)(D) activity review, and the business associate question.
- [SOC 2 endpoint logging](https://etducky.com/compliance/soc2-endpoint-logging): the CC6 and CC7 control mapping and the records available as audit evidence.
- [GLBA and FFIEC endpoint monitoring](https://etducky.com/compliance/ffiec-glba-endpoint-monitoring): which regime applies, 314.4(c)(8) logging, (c)(5) MFA, (c)(3) encryption, (c)(6) disposal, (d) monitoring alternatives.
- [Public sector procurement](https://etducky.com/compliance/public-sector-procurement): authorization status, US data residency, sub-processors, self-hosted deployment.

## Links

- Homepage: https://etducky.com
- Documentation: https://etducky.com/documentation
- Patch Management and Software Catalog: https://etducky.com/documentation/patch-management
- Behavioral Detections: https://etducky.com/documentation/behavioral-detections
- Approved Applications and Binary Integrity: https://etducky.com/documentation/approved-applications
- Security: https://etducky.com/documentation/security
- Linux Agent: https://etducky.com/documentation/linux-agent
- Time Tracking and Timesheets: https://etducky.com/documentation/time-tracking
- PSA Integrations and Billing: https://etducky.com/documentation/psa-billing
- Pricing: https://etducky.com/pricing
- Blog: https://etducky.com/blog
- What Polling, auditd, and eBPF Can See Through Linux RMM agents (evaluation guide): https://etducky.com/blog/linux-rmm-agent-polling-auditd-ebpf
- Getting Started: https://etducky.com/documentation/getting-started

## Comparison Context

ET Ducky is an RMM. Patch management, remote desktop, scripting, alerting, ticketing, and automations are included with kernel-level diagnostics (ETW on Windows, eBPF on Linux) and behavioral security in one agent and one dashboard. It is endpoint- and fleet-focused rather than an application performance monitoring tool. Pricing is published at https://etducky.com/pricing (billed per device with optional AI query packages, and any query subscription includes an additional 20 agent seats at no extra cost). Its limitations: no macOS or mobile support, and its PSA layer is a time-to-invoice pipeline (timers, session auto-capture, weekly timesheet approval, per-member rates, draft Stripe invoices in the MSP's own account, signed billing webhooks) rather than a full PSA suite: there is no tax handling, contract management, AR aging, or accounting sync, and full service-desk workflows run through the bi-directional Jira/ServiceNow integration.