SOC 2 endpoint logging and monitoring controls

Attestation status

Every third-party service the platform depends on does hold a current attestation. That is a real fact about the supply chain and a limited one about ET Ducky itself.

Control mapping

This is the mapping as it appears in the whitepaper, reproduced here so a reviewer does not have to open a 40-page document to find it.

CC7.2: what monitoring evidence looks like

CC7.2 asks that the entity monitor system components for anomalies indicative of malicious acts, natural disasters and errors, and that it analyze them to determine whether they represent security events. Behavioral detection against kernel telemetry is a direct fit, because the evaluation runs on events the operating system emitted rather than on a report from the thing being monitored.

Ten always-on rules run on both Windows and Linux: mass file access, mass file rename to ransom extensions, ransom-note patterns, shadow copy and backup deletion, suspicious execution chains, reverse-shell heuristics, privilege escalation from non-interactive parents, unusual outbound traffic from system daemons, a crypto-miner heuristic, and a kill-chain rule that fires when two or more of the others occur within five minutes.

Two further mechanisms produce anomaly evidence and both ship default-off with a shadow mode, which is itself useful to an auditor because it shows tuning before enforcement:

• Approved-app binary integrity. Agents report a SHA-256 of each approved application's primary binary. The cloud holds a per-organization ledger with trust on first use, the reference elected by agent majority, and any later divergent hash for the same application, version and architecture raises a detection once.
• Fleet behavioral baselines. The cloud learns a per-application profile from the organization's own fleet in 15-minute rollups and flags outlier hosts.

CC6.1: logical access and tenant isolation

Isolation runs in two layers on every database read and write. Application-layer query filters add the organization predicate to every query against tenant-scoped entities, so a controller cannot omit it. Database-layer row-level security policies enforce the same predicate in PostgreSQL, so a query that escapes the application filter is still rejected.

Lookups that must run before tenant context exists, such as bearer token validation and webhook handlers, opt in to a documented bypass scope and are flagged by an in-tree static analyzer if introduced without justification. There is no administrative path to cross-tenant access. Admin endpoints are bound to localhost and provide no cross-organization view.

At the console layer, identity is handled by Clerk. ET Ducky does not store passwords or manage sessions. TOTP, SMS and passkey factors are available, and SAML or OIDC single sign-on is available on Clerk's enterprise plan.

CC7.3 and CC7.4: evaluating and responding to events

On a detection at or above the confidence threshold, containment is automatic and scoped to the implicated endpoint. A ticket is opened in the connected ticketing system carrying the alert evidence and a note that isolation was applied, which gives the incident a dated record without an operator present.

Release is separately attributable. Lifting isolation requires an authenticated dashboard request plus independent approval from a person at the device, through either a single-use HMAC-TOTP code or an on-device approval prompt with a five-minute window. A stolen dashboard session cannot lift containment on its own.

Data belonging to an organization under a security hold is exempt from the retention purge, so evidence survives an investigation that runs longer than the retention window.

Using ET Ducky as evidence in your own audit

A vendor without its own report can still be the source of evidence for your report. What your auditor tests is the completeness and integrity of records in your environment. The records most often useful:

Where the vendor's own status does matter is CC9.2, vendor and business partner risk. An auditor will ask what due diligence you performed on a vendor that runs privileged code on your endpoints and holds no report of its own. The whitepaper, the security posture page and a completed questionnaire response are what that file is built from.

What the mapping is not

It is not an attestation, it has not been examined by an independent auditor, and it covers only the criteria a platform can address. Nothing here speaks to CC1 through CC5, which cover the control environment, communication, risk assessment, monitoring of the control environment, and control activities at the organizational level. Those are governance and no product supplies them.

Related: cyber insurance endpoint control questions and GLBA and FFIEC endpoint monitoring evidence.