ARX Trace: forensic investigation and threat hunting, every trace tells a story
When something happens you need to understand what, where and how, with evidence rather than guesswork. ARX Trace reconstructs the facts from the evidence collected by the ARXDOME probes.
How it works
With the ARXDOME investigation probe you launch collections and hunts across multiple machines, choosing from a library of artifacts. Each collection has its results and logs, plus the status of the server and the machines; pending collections are monitored automatically.
Event exploration shows every enriched event, with filters by family, machine, account, rule, MITRE technique, source, destination and country, and the full document.
File changes tell you what changed and where, with activity by folder. MITRE ATT&CK mapping shows the chain of tactics and techniques by company, by rule level and over time.
Real tools for the analyst’s work
ARX Trace gives analysts the tools to reconstruct an incident. Today root-cause and lateral-movement reconstruction is carried out by our analysts using these tools: we do not promise automatic reconstructions.
A first list of cases already exists. Full incident management, with timeline, evidence, tasks, assignees and customer reports, is planned.
What it offers: ARX Trace
- Collections and hunts across multiple machines, from a library of artifacts
- Event exploration with filters and the full document
- File changes, with activity by folder
- MITRE ATT&CK mapping by company and over time
- Monitoring of pending collections
Why choose it
- Evidence collected directly from the machines
- Every event already enriched and filterable
- The attack chain read in the language of MITRE
- Analysts working on the same data you see
Other modules
Reconstruct the facts with ARX Trace
Let’s talk about how to handle an incident with evidence and method.
Contact us