Outcomes

Know what happened.Know what you can say.

Turn investigative findings into a clear account for your response team, leadership, and counsel.

Case 20200918-001 Host CITADEL-DC01 19 Sep 2020 11 evidence files, hashed TLP:Amber

Established Inferred Open

  1. Roughly 96 credential attempts in the capture, then a successful logon. Capture and event log agree.
  2. A service creation event plus the binary on disk, both hashed and anchored to the same evidence file.
  3. Logon type 10 on the destination host and a cached domain credential written there. Two hosts, one account.
  4. The archive path survives in the master file table. The archive was deleted, so staging is inferred.
  5. A pure-upstream burst matching the archive byte size exactly. Corroborated across capture and disk.
  6. The dump capability sits in injected memory and every credential store was recoverable. No artifact of the dump itself survives.
Choose a reader

Diagram — the structure of a ProtecTRON account

The account

One account, still developing

The scope of an incident, the findings that support it, and the questions still open, held in one account.

Direct the response and brief the people who depend on your judgment, while the investigation continues.

Depth

The right depth for the next conversation

A containment decision and a board discussion need different levels of detail. Both rest on the same facts.

ProtecTRON draws each account from the same investigation, at the depth its reader needs.

The depth is set by the conversation, not by a fixed template. Switch the reader context on the record to see the same facts change register.

Support

Ready for the follow-up question

When someone asks what supports a conclusion, you need more than a confident summary.

Findings stay connected to their supporting evidence, and unresolved questions stay visible. Your analysts keep judgment over the case.

A shorter account should never turn an open question into a settled fact. Select a finding on the record to see what stands behind it.

Deployment

The case stays inside your boundary

The sensitivity of an investigation should not force a compromise over where its evidence lives.

Deploy in your own cloud, on your infrastructure, or in an air-gapped environment. No vendor-hosted backend, and no requirement to send evidence to TronLabs.

Next

What do you need to put in front of leadership?

Tell us what your next incident report needs to make clear.

Start a conversation