Hexnode XDR Adds macOS Support, Threat Intelligence and Automated Remediation
Hexnode has expanded Hexnode XDR with macOS support, threat intelligence integrations, alert prioritization and automated remediation. The enterprise security platform now connects threat investigation more closely with endpoint containment, patching and corrective action.
- Hexnode XDR now supports macOS alongside Windows.
- Mandiant and Recorded Future integrations add external threat intelligence context.
- Alert prioritization and asset scoring help focus investigations.
- Automated remediation can trigger predefined fixes based on rules and policies.
- Hexnode plans deeper AI-assisted investigation and orchestration.
XDR expands detection and triage capabilities
Hexnode, the enterprise software division of Mitsogo, announced the enhancements on Nov. 10, 2026. Support for macOS extends endpoint detection and response across macOS and Windows.
The updated platform brings threat signals and supporting context into a centralized incident view. Integrations with Mandiant, also referred to in the announcement as Google Threat Intelligence, and Recorded Future cross-reference endpoint activity with external threat intelligence to help identify known threats and indicators.
Security teams can also examine suspicious files in an isolated sandbox, with the results fed back into detection. Hexnode says its anomaly detection can surface unusual activity that does not match known threat signatures, while exclusion policies for trusted files, applications and processes are designed to reduce false positives.
Prioritization connects alerts to response
Hexnode XDR ranks alerts by severity and urgency, allowing analysts to focus on higher-priority activity instead of reviewing alerts in the order they arrive. Its asset scoring feature assigns endpoints a dynamic risk score based on defined risk parameters, helping teams identify devices that need closer attention.
Hexnode Genie AI provides plain-language alert summaries for triage. The company's Analyse with Genie feature uses live incident data to explain what happened, identify affected systems and recommend a fix.
The platform also offers one-click endpoint isolation while maintaining management access through Hexnode. Vulnerability management identifies vulnerabilities and missing patches, with remediation carried out through Hexnode UEM. Automated remediation can trigger predefined fixes based on configured rules and policies.
Hexnode's native integration with Hexnode UEM brings threat detection, device intelligence and endpoint management together. The company says this reduces the manual steps needed to contain threats and address the endpoint exposure found during an investigation.
A foundation for AI-assisted SOC operations
Custom dashboards let teams tailor security information to their roles and monitoring priorities. Integrations with Splunk and QRadar connect Hexnode XDR with existing security information and event management systems for broader investigation and reporting.
Hexnode says alert prioritization, asset scoring and automated remediation create a framework for more AI-assisted security operations center workflows. Hexnode Genie AI adds live incident context to investigation and response decisions, while deeper AI-assisted investigation and orchestration across XDR and the wider Hexnode platform are on the company's roadmap.
“More alerts was never the request. Fewer steps between the alert and the fix, that was the request,” Apu Pavithran, CEO and Founder of Hexnode, said during the HexCon26 opening keynote, according to the announcement. For users, the update is aimed at shortening the path from detecting suspicious activity to isolating affected devices, fixing vulnerabilities and applying predefined responses.
