Skip to main content

Screenshots & Walkthrough

This walkthrough follows the platform from endpoint monitoring to analyst investigation.

Endpoint monitoring​

Endpoint agent status view

The endpoint monitor shows service status, agent identity, operational state, and endpoint-side visibility. It gives operators a local view of the agent that is collecting telemetry and preparing alerts.

Triggered agent events​

Endpoint agent events view

Triggered events are transformed into structured alert records before upload. The agent-side view helps validate that local detection is working before the alert reaches the cloud dashboard.

Analyst event table​

Console events table

The analyst console centralizes detections from enrolled endpoints. Events can be searched, filtered, sorted, marked handled or unhandled, opened for detail review, or selected for correlation.

Event details​

Event details overview

The event details modal exposes the evidence behind the alert: timestamp, hostname, agent ID, category, process fields, command line, file/signature data, network fields, and system metadata. VirusTotal lookup controls are available when hash evidence exists.

Process tree​

Process tree analysis

The process tree reconstructs parent-child execution context. This is important because a detection usually makes more sense when the initiating process and child process chain are visible.

AI true-positive analysis​

True-positive AI analysis

AI analysis summarizes the event, explains reasoning, identifies indicators, maps behavior to MITRE ATT&CK, and recommends next steps. The output is grounded in alert context and retrieval evidence.

AI false-positive reasoning​

False-positive AI analysis

The same workflow can explain why an event appears legitimate or lower risk. This matters because an EDR workflow should reduce unnecessary investigation work as well as escalate true threats.

Follow-up investigation chat​

AI analysis with follow-up chat

After reading the initial analysis, an analyst can ask event-specific questions. The chatbot uses the selected alert context rather than answering as a generic security assistant.

Broader device activity​

AI chatbot ongoing attack analysis

Follow-up chat can help reason about related behavior on the same endpoint, such as repeated discovery commands or reconnaissance patterns.

AI chatbot recommendations

The chatbot can turn alert context into prioritized investigation and response recommendations.

IOC extraction​

AI chatbot IOC extraction

When evidence supports it, the AI workflow can extract investigation-relevant IOCs such as commands, paths, domains, IP addresses, hashes, and host identifiers.

Multi-alert correlation​

Multi-alert correlation

When multiple alerts appear related, the console can analyze them together to produce a broader incident-level summary, attack-chain assessment, combined risk, and recommended actions.