Data sources
- Per-host retained access history
- Earlier reports and their evidence
- Customer case notes
Capability
Threat hunting and historical investigation
Ask a new question of old evidence. Replay any past window, follow a source back through weeks of history, and test a hypothesis before acting on it.
Available in current prototype
Past windows are replayed on demand, and every report names related activity found in the preceding sixty days.
Operational problem
The problem
Most detections arrive late. When a new indicator becomes known, the useful question is whether it was already present — last week, last month, on which hosts — and whether anything else behaved the same way. That question is unanswerable if the evidence was summarised, sampled or shipped away.
Workflow
How it works
- State the hypothesis: a source, a behaviour, a referral pattern or a time window.
- Replay the retained record for that window on each protected host independently.
- Expand along relationships — same network owner, same referral context, same device characteristics, same pages — across a long look-back period.
- Record the result as confirmed, supported or unverified, with the alternative explanations considered.
Actionable outputs
- Window replays
- Retrospective matches for new indicators
- Hunting notes with evidence grades
Trust boundary
Hunting runs on the customer's retained evidence. It never queries a vendor service and never contacts the source under investigation.
Benefit
New knowledge is applied to the whole past, not only to tomorrow's traffic.
Related
Other capabilities
- Counter-reconnaissance and behavioural detection Available in current prototype
- Intelligence fusion and relationship discovery Available in current prototype
- Attack-path and exposure analysis Available in current prototype
- Active defence and controlled interdiction Available in current prototype
- Forensics, evidence integrity and reporting Available in current prototype
- Sensor reliability, tamper detection and operational health Available in current prototype
SOVEREIGN BY DESIGN.
Discuss this capability
Tell us what you need to protect. A briefing is an engineering conversation; it never needs your credentials, network inventories or logs.