01
Signals that share an entity are fused
Forty login probes on Monday, one success on Wednesday, a share enumeration an hour later: three quiet alerts become one case because they share an account and a host.
Investigate
Low and slow, joined up.
The Passive Auditor fuses weak signals that share entities into a single case, so a campaign spread over days and accounts is reviewed as one story instead of many quiet alerts.
How it works
Weak signals, one story.
- Signals that share entities are fused into one case.
- Each case carries hash-based evidence provenance.
- ATT&CK context and entities attached to every step.
02
Provenance by hash
Every piece of evidence in a fused case carries a hash-based identifier, so an auditor can confirm that what the case shows is what was collected.
03
ATT&CK on every step
Each fused step is labelled with its technique, so the case reads as a campaign, not a list.
Specifications
| Output | Fused cases |
|---|---|
| Provenance | Hash-based evidence identifiers |
| Mapping | MITRE ATT&CK |