TechDetechtives is built from parts that each answer one question an analyst asks: what happened, where, how bad it is, and what the attacker used. They share one platform, one case system and one set of evidence, and every one of them runs on machines you control.
The whole TechDetechtives stack, from the machines you protect up to the people who respond. Each part works in its own layer and passes what it finds to the layer above, into one evidence store. Select a part to read more about it.
Sensors on the wire, with an inventory of IT and industrial devices.
Endpoint agent that records, detects and responds on Windows.
Decoy services that no real user should ever touch.
Logs from servers, firewalls, mail and cloud services.
Parts marked "In development" are being built and are not yet available. Every part can be deployed on its own and joined to the rest later.
The centre of TechDetechtives: where evidence is collected, alerts are raised and every serious one becomes a case.
Detect
Logs from servers, endpoints and network sensors are collected in one place and checked against detection rules around the clock. Analysts can search back through everything that was recorded.
Respond
Every alert at medium severity or above opens its own case automatically, so nothing is missed between the alert and the person who has to act on it.
Prevent
Systems are scanned for known weaknesses. Findings appear on a dashboard, go into the platform beside the alerts, and serious ones become cases to track the fix.
See
Sensors inspect traffic as it crosses the network. An inventory is built from what they see, including industrial devices and the commands sent to them, and anything new after a learning period is flagged.
Trap
A decoy machine offers fake services that no legitimate user has any reason to touch. Any contact with it is a strong sign of someone exploring the network, and raises an alert and a case.
Products that plug into the platform and feed it what they find. Each one can also be deployed on its own.
Analyse
A private sandbox for suspicious files, links and e-mails. Samples are detonated in throw-away Windows and Linux machines on your own hardware, and the verdict goes straight into the platform as an alert and a case. No sample, link or hash is ever sent to an outside service.
Anticipate In development
Threat intelligence gathered from many feeds, including dark-web monitoring, and delivered to the platform as an offline feed, so it works on networks with no internet access.
Protect In development
A lightweight agent for Windows endpoints that records what happens on the machine, detects attack techniques and lets responders act, reporting into the platform. Built to work fully offline.
An example of the parts handing work to each other when a phishing e-mail arrives.
An analyst submits it to the TDZer0 sandbox, or a playbook sends it automatically.
The attachment runs in a Windows machine and the link opens in an isolated browser. The attachment steals passwords; the link is a fake sign-in page.
A malicious verdict arrives as an alert, and a case opens with the sandbox report linked.
The addresses the sample contacted are searched across the network records. One workstation already talked to them yesterday. The threat intelligence feed receives the new indicators.
That workstation is contained and checked for known vulnerabilities, and the case keeps the full story.