Investigate a suspicious finding
Start with a deterministic alert, inspect its attached network artifacts, review related activity, and use AI-assisted analysis to choose the next investigation step.
Evidence citations: Active development
Operational Scenarios
Use Cases
BlackBox Analyst workflows for network investigation. Features marked as active development still require private-preview verification.
Reconstruct what happened
Import or capture relevant traffic, reconstruct sessions, organize findings on an investigation timeline, and produce an incident summary without uploading packet data to a third party.
PCAP replay and timeline: Active development
Keep analysis near the network
Keep collection, detection, and AI-assisted explanation near the operator. The operator controls any future remote-model connection.
Disconnected packaging: Planned
Examine detection coverage
Observe which deterministic rules trigger during controlled activity, review supporting evidence, add ATT&CK context, and identify gaps in visibility or coverage.
ATT&CK correlation: Active development
Shared Standard
Evidence requirements apply across workflows
AI can explain and correlate findings or suggest a next step. It does not create alerts, and unsupported statements are not treated as observed facts.
Observed artifact
Deterministic finding
Cited analysis
Human conclusion
Tell us about your investigation workflow
Private-preview feedback will inform which evidence and analyst workflows receive priority.
Request Early Access