Some attacks never trip a rule. Mitigate takes intelligence and hypotheses, checks them against your environment, and hunts across EDR, SIEM, identity, cloud and the other tools you run. What it finds becomes a case, a rule, or a response that passes your gates.
A hunt can begin with a campaign, an actor, a CVE, an indicator, an ATT&CK technique or a hunch from one of your analysts. Mitigate first checks whether it applies to the software, assets and accounts you actually have. After that it writes queries for each connected system in that system's own query language, follows leads as results come in, and investigates anything suspicious. A hunt that worked can be saved as a rule or scheduled to run again. The telemetry is never moved.
A proof of concept with Mitigate is scored on these measures, against your own alerts and your own tools.
| No. | Measure | Definition |
|---|---|---|
| 01 | Hypotheses from intel | Intelligence items that became testable hunt hypotheses. |
| 02 | Hunts across all sources | Hypotheses checked against every data source they needed, as a share of the total. |
| 03 | Hypothesis to result | Median time between approving a hypothesis and the hunt finishing. |
| 04 | Hunts on a schedule | Hunts saved to run again on a schedule or continuously. |
| 05 | Findings into rules | Confirmed findings that led to a new rule or a tuned one. |
| 06 | Findings acted on | Confirmed findings where the required response was carried out. |
Give us one hunch your team never had time to chase. We run it across your tools and show you what came back.