Evidence Pipeline

How BlackBox Analyst Works

Detection rules produce findings. AI can explain those findings and connect related evidence for the analyst.

Separation of Duties

Detection and analysis have separate jobs

Detection and interpretation are intentionally separated. A deterministic pipeline creates findings, severity, and supporting artifacts. AI uses that evidence to explain context and suggest investigation paths. It does not create alerts.

Deterministic detection

  • Observes captured network activity
  • Evaluates explicit detection logic
  • Produces findings and severity
  • Attaches supporting artifacts
  • Remains the source of truth

AI-assisted analysis

  • Explains findings in technical language
  • Connects related observed activity
  • Builds investigation context
  • Suggests the next questions to ask
  • Does not add unsupported evidence
Processing Path

From traffic to evidence-backed output

Each stage keeps a record of what was observed. Features still in development are labeled in the pipeline.

Traffic Capture or PCAPPCAP replay: Active development
Protocol and Flow AnalysisFull reconstruction: Active development
Deterministic Detection
ATT&CK ContextActive development
Local AI Analysis
Evidence-Backed Analyst Output
Evidence Boundary

Observed facts remain distinct from generated analysis

Observed

Captured packets, protocol fields, reconstructed activity, and other artifacts produced by the collection pipeline.

Detected

Rules-based findings with severity and supporting evidence generated by deterministic logic.

Analyzed

AI-generated explanation, correlation, and recommendations that cite observed artifacts or deterministic findings.

Constraint: AI output is analysis, not evidence. A generated statement cannot be presented as an observed fact.

Private Preview

Deployment target

The initial private preview targets a standalone Windows desktop experience. Installation, model distribution, licensing, and disconnected update workflows remain in development.

Now

Windows desktop private preview

Local prototype packaging for invited evaluators.

Planned

Disconnected enterprise packaging

  • Enterprise software edition
  • Preconfigured investigation appliance
  • Air-gapped deployment bundle
  • Signed offline updates

Test the investigation workflow

BlackBox Analyst is in development and accepting private-preview inquiries.

Request Early Access