Reports and feeds are only useful once someone acts on them. Mitigate works out which of the actors, campaigns, CVEs, indicators and techniques in them actually touch your environment, and turns those into cases, hunts, rules and responses.
Each new threat is compared with your assets, identities, software, open vulnerabilities, existing rules and recent activity. When it applies, agents query the connected systems directly, investigate any matching evidence and then hunt further, update rules or run approved responses. Intelligence work and SOC work happen in the same flow, so there is no feed pipeline into the SIEM to keep running and nothing to hand over between teams.
A proof of concept with Mitigate is scored on these measures, against your own alerts and your own tools.
| No. | Measure | Definition |
|---|---|---|
| 01 | Intake to decision | Median time from receiving an item to a written call on whether it applies. |
| 02 | Calls upheld | Share of relevance calls that analysts kept after review. |
| 03 | Confirmed matches | Validated hits on your own assets, accounts and recent activity. |
| 04 | Items hunted | Relevant intelligence items that were hunted to completion. |
| 05 | Items into rules | Relevant intelligence items that led to a tested detection. |
| 06 | Responses carried out | Confirmed findings where the required response was completed. |
See which ones touched your environment, and what Mitigate would have done about each of them.