01
Context survives the hand-off
Priority, ownership, scope and response state stay attached when an analyst opens the incident.
Investigate
Behaviour is relational.
kymeer keeps users, hosts, services and destinations on one entity graph. Investigations show the path behind a detection — who touched what, through which relationship — not just a score.
How it works
Relationships are the evidence.
- Convergence, rarity and cohort-outlier analytics on the graph.
- The graph path, entities and scope are evidence inside the case.
- Rare-for-this-entity and rare-for-everyone are treated differently.
02
Rare for this entity, or rare for everyone
A finance analyst reaching a payroll database is normal for the cohort and unusual for the person. kymeer scores convergence, rarity and cohort outliers separately, so the alert says which kind of unusual it is.
03
The path is the evidence
When a detection fires, the graph path — which account, through which host, to which destination — is attached to the case. Nobody redraws it for the report.
Specifications
| Entities | Users, hosts, services, destinations |
|---|---|
| Analytics | Convergence · rarity · cohort outliers |
| Use in cases | Graph path and entity scope shown as evidence |