Security Tool & Platform Reference

Abuse.ch

Malware-infrastructure tracking project (a research project at Bern University of Applied Sciences; Spamhaus is its primary data licensee). Platforms: MalwareBazaar (samples), URLhaus (malware URLs), ThreatFox (indicators of compromise, IOCs), Feodo Tracker (botnet command-and-control, C2), SSLBL (malicious certificates and JA3) and YARAify, plus a unified Hunting search. Free for commercial and non-commercial use; the APIs take a free personal Auth-Key.

In triage: a fast check of a hash, URL or C2 address against community malware tracking.

Watch for: the old Ransomware Tracker is long gone; absence from these lists is not evidence of safety.

Operator: abuse.ch (Bern University of Applied Sciences)

CISA Advisories

U.S. Cybersecurity and Infrastructure Security Agency advisories on vulnerabilities and active threats, with mitigation guidance.

In triage: joint advisories list indicators and ATT&CK-mapped behavior for active campaigns; match them to the case’s observables.

Watch for: advisory indicators age fast; behavior sections outlast the IP lists.

Operator: CISA (U.S. government) · Also: CISA KEV

CISA KEV

The Known Exploited Vulnerabilities catalog: CVEs CISA has evidence of being exploited in the wild, each with a remediation due date for U.S. federal agencies.

In triage: an exploitation attempt against a KEV-listed CVE on an unpatched, reachable asset is the combination the Risk phase treats as most urgent.

Watch for: KEV lists what is known to be exploited, not everything that is; a missing entry is not a clean bill.

Operator: CISA

E-ISAC

Electricity sector ISAC; threat intel, IR support, and risk analysis tailored to grid operators.

In triage: sector-specific campaign context for OT and utility environments.

Watch for: sharing is governed by TLP markings; check them before an indicator leaves the case.

Operator: NERC (North American Electric Reliability Corporation)

FBI Flash Reports

Rapid high-priority notifications about imminent cyber threats targeting public and private partners.

In triage: technical indicators and TTPs for a specific, current threat.

Watch for: distribution is often TLP:AMBER or narrower; respect the marking.

Operator: FBI (U.S. government)

FIRST EPSS

The Exploit Prediction Scoring System: a daily probability, per CVE, that the vulnerability will be exploited in the wild in the next 30 days.

In triage: a second exploitability signal next to KEV when an attempt targets a CVE.

Watch for: EPSS describes the population of attacks, not your asset; it says nothing about reachability or whether the attempt succeeded.

Operator: FIRST (Forum of Incident Response and Security Teams)

FS-ISAC

Global financial-sector ISAC providing real-time alerts, incident coordination, and member collaboration.

In triage: peer sightings of fraud and intrusion campaigns aimed at financial institutions.

Watch for: member-shared indicators vary in confidence; corroborate before blocking.

Operator: FS-ISAC (member organization)

Health-ISAC

Healthcare-sector ISAC; threat intelligence, incident response coordination, and best practices for clinical environments.

In triage: campaign context for attacks on hospitals, medical devices and health data.

Watch for: sector reports can lag the first wave; pair them with your own telemetry.

Operator: Health-ISAC (member organization)

LevelBlue Open Threat Exchange (OTX, formerly AlienVault OTX)

Collaborative threat-intel exchange aggregating IOCs from a global community, with SIEM/automated integrations. Free community “pulses” of IOCs; quality varies by contributor, so corroborate before acting.

In triage: a quick look at whether an indicator appears in a community pulse, and alongside what.

Watch for: pulses are rarely retired, so old infrastructure lingers as “malicious”.

Vendor: LevelBlue · Formerly: AlienVault OTX (AT&T Cybersecurity)

Renamed 2024 formerly AlienVault OTX Owner: LevelBlue Checked 2026-10-13 Source

MS-ISAC

Multi-State ISAC for U.S. state, local, tribal, and territorial governments; alerts, IR, and risk management resources. Operated by the Center for Internet Security (CIS). DHS/CISA funding ended after 30 September 2025, and MS-ISAC moved to fee-based membership, so check current membership terms.

In triage: SLTT-specific advisories and, for members, incident support.

Watch for: services an SLTT team relied on before October 2025 may now sit behind a paid tier.

Operator: Center for Internet Security (CIS)

NVD / EUVD

Public vulnerability databases: the U.S. National Vulnerability Database (NIST) and the EU Vulnerability Database (ENISA). Both enrich CVE records with severity scores, affected products and references.

In triage: what a CVE in an alert actually affects, and whether the targeted product and version match.

Watch for: NVD enrichment has run with a backlog, so a fresh CVE may carry no score yet; read the vendor advisory too.

Operators: NIST (NVD) · ENISA (EUVD)

UK NCSC

UK National Cyber Security Centre; guidance, threat intelligence, and IR services across public and private sectors.

In triage: advisories and joint reports with indicators and behavior for active campaigns.

Watch for: joint advisories are often co-published; one campaign, several URLs.

Operator: UK government (part of GCHQ)

Anomali ThreatStream

Commercial TIP: collects, analyzes, and prioritizes threat data with enrichment and risk scoring; integrates with existing security stacks.

In triage: one place to see every feed that lists an indicator, with a merged confidence score.

Watch for: a merged score inherits the weakest feed’s errors; open the sources.

Vendor: Anomali

Cloudflare Cloudforce One

Cloudflare’s threat-research team and intelligence service; produces actionable indicators, campaign tracking, and disruption support against active adversaries.

In triage: campaign reporting drawn from Cloudflare’s view of global DNS and HTTP traffic.

Watch for: a research service, not a monitoring product; it does not watch your cloud.

Vendor: Cloudflare

CrowdStrike Counter Adversary Operations

CrowdStrike’s combined threat-intelligence and managed-hunting organization; publishes adversary profiles under its animal-themed naming (for example SCATTERED SPIDER).

In triage: actor context and indicators surfaced directly in the Falcon console.

Watch for: each vendor names actors differently; map names before you merge reports.

Vendor: CrowdStrike · Also: Falcon OverWatch

Google Threat Intelligence

Google’s commercial intelligence product, combining Mandiant’s frontline research with VirusTotal’s crowdsourced data and Google’s own threat analysis.

In triage: actor and malware-family context plus enterprise VirusTotal access in one portal.

Watch for: Mandiant reports now live here; older links to standalone Mandiant Advantage may redirect.

Vendor: Google Cloud · Formerly: Mandiant Threat Intelligence

Renamed formerly Mandiant Threat Intelligence Owner: Google Cloud Checked 2026-10-13 Source

Intel 471

Commercial deep/dark-web monitoring with adversary infrastructure, TTP, and threat-actor behavior intelligence.

In triage: whether your domain, credentials or access are being sold or discussed in criminal forums.

Watch for: forum claims are adversary marketing; treat them as leads, not facts.

Vendor: Intel 471

Microsoft Defender Threat Intelligence (now in Defender XDR and Sentinel)

Successor to RiskIQ PassiveTotal (acquired by Microsoft, 2021). Standalone MDTI was retired on August 1, 2026; its passive DNS, WHOIS, certificate and threat-actor data now surface in the Microsoft Defender portal (Threat Analytics, Intel explorer and entity-page enrichment) and in Microsoft Sentinel, at no extra cost for Defender XDR and Sentinel customers.

In triage: passive DNS and certificate pivots on a domain or IP, from the Defender portal’s entity pages.

Watch for: guides that still point to the standalone MDTI portal or API; those are gone.

Vendor: Microsoft · Formerly: RiskIQ PassiveTotal

Deprecated 2026-08 formerly RiskIQ PassiveTotal Owner: Microsoft Successor: Microsoft Defender XDR Checked 2026-10-13 Source

MISP

Open-source threat-intelligence platform and sharing standard: stores events, attributes and galaxies, and syncs them between trusted communities.

In triage: the free TIP most ISACs and CERTs share through; look an indicator up and see who reported it, when, and in what context.

Watch for: warning lists and decay models matter; without them, stale shared indicators stay “hot”.

Project: MISP (open source, CIRCL-led)

MITRE ATT&CK

MITRE’s public knowledge base of adversary tactics, techniques and procedures observed in real intrusions, with Enterprise, Mobile and ICS matrices. Enterprise v19 (April 2026) split Defense Evasion into Stealth and Defense Impairment. Triage uses it as a shared vocabulary: map what the evidence shows to technique IDs, record the version, and remember that a mapping names behavior without scoring it. See the ATT&CK Tactic, Technique and Procedure entries.

In triage: name the behavior you observed with a technique ID so the next analyst, the detection team and the report all mean the same thing.

Watch for: a technique label is a description, not a verdict; mapping a benign admin action to a technique does not make it malicious.

Operator: MITRE · Full entry: C.L.E.A.R. · Also: Uncover: MITRE ATT&CK

OpenCTI

Open-source threat-intelligence platform that models intelligence as a STIX 2.1 knowledge graph (actors, campaigns, indicators, observables and their relationships).

In triage: pivot from one indicator to the actor, campaign and sibling indicators it is linked to.

Watch for: graph links are only as good as the connectors that created them; check provenance.

Vendor: Filigran (open source)

Recorded Future

Threat-intelligence platform combining machine learning with human analysis across open, dark, and technical sources. Owned by Mastercard since December 2024.

In triage: risk scores with the evidence rules behind them, for IPs, domains, hashes and CVEs.

Watch for: read which rule set the score; an old sighting can keep a score high.

Vendor: Recorded Future (Mastercard)

Acquired 2024-12 Owner: Mastercard Checked 2026-10-13 Source

SANS Institute

Training, certification, and research organization; publishes threat research and runs the Internet Storm Center (ISC).

In triage: ISC diaries and port and scanning trends give quick context on a new exploit wave.

Watch for: a training body, not a feed; its research informs, it does not score your indicators.

Operator: SANS Institute

ThreatConnect

Threat-intelligence platform (TIP) that aggregates and scores feeds, links indicators to internal telemetry, and runs intel-driven automation playbooks; also offers cyber-risk quantification. Now part of Dataminr (acquisition announced October 2025).

In triage: see which feeds list an indicator and whether it already matched elsewhere in your environment.

Watch for: it automates intel workflows; it does not simulate attacks.

Vendor: Dataminr

Acquired 2025-11 Owner: Dataminr Checked 2026-10-13 Source

Zscaler ThreatLabz

Zscaler’s threat-research team; publishes malware and campaign research drawn from Zscaler’s cloud traffic and feeds detections into its security services.

In triage: write-ups and indicators for campaigns seen across Zscaler’s proxy traffic.

Watch for: a research team, not a sandbox product you can submit to directly.

Vendor: Zscaler

AbuseIPDB

Community database of IP addresses reported for abuse (scanning, brute force, spam), with report counts, categories and a confidence-of-abuse score.

In triage: a quick read on whether an IP has a history of hostile behavior.

Watch for: mass scanners collect reports too, so a high score does not mean you are being targeted; shared and cloud IPs churn.

Operator: AbuseIPDB

CyberChef

Browser-based “cyber Swiss army knife” from GCHQ for decoding, decompressing, parsing and transforming data with chained recipes.

In triage: unpack a Base64, UTF-16LE PowerShell command or a gzip blob from an alert without running anything.

Watch for: use a local copy for sensitive data; the hosted page runs in your browser, but your organization may require the offline build.

Project: GCHQ (open source)

GreyNoise

Filters internet background-scan noise so SOCs focus on targeted attacks. IP context with malicious vs. benign classification.

In triage: separate a source that scans the whole internet from one that is aimed at you.

Watch for: an IP GreyNoise has never seen is not proof of targeting (new infrastructure, low-volume scanners), only a reason to look harder.

Vendor: GreyNoise Intelligence

IPinfo

IP-data service: geolocation, owning network (ASN), company and hosting or privacy-service flags for an address.

In triage: is this sign-in IP a hosting provider, a VPN, or a residential ISP?

Watch for: geolocation is an estimate; never build an impossible-travel conclusion on city-level data alone.

Vendor: IPinfo

PhishTank

Community-validated database of phishing URLs; supplies security tools and browsers with up-to-date intelligence.

In triage: a quick check of whether a reported URL is already a known phish.

Watch for: new-user registration has been disabled for years, which limits submissions and disputes; a miss means little.

Operator: Cisco Talos

Spur

IP-intelligence service focused on anonymization infrastructure: commercial VPNs, residential proxy networks and Tor, with the service behind an address where known.

In triage: tells you a “home ISP” sign-in actually came through a residential proxy network.

Watch for: proxy membership changes daily; record the lookup time with the result.

Vendor: Spur

urlscan.io

Service that loads a URL in a browser and records the rendered page, screenshot, requests, redirects and hosting details; searchable history of earlier scans.

In triage: see a phishing page and its kit without opening it yourself, and find sibling pages by shared resources.

Watch for: public scans are visible to everyone, including the phisher; use private or unlisted scans for URLs that carry a victim’s address or token.

Vendor: urlscan GmbH

VirusTotal

Multi-engine reputation for files, URLs, domains and IPs, owned by Google (part of Google Threat Intelligence). Search by hash first. An uploaded file is shared with VirusTotal’s premium subscribers, and adversaries monitor it for their own samples, so never upload internal documents, customer data or samples from a targeted intrusion without approval. The public API is for non-commercial use.

In triage: engine verdicts, first-seen date, relations and sandbox behavior for a hash you already have.

Watch for: zero detections on a fresh sample proves nothing, and a handful of generic detections on a rare internal tool proves little.

Vendor: Google

WHOIS / RDAP

Domain-registration lookup. For gTLDs, RDAP (RFC 9082/9083) replaced WHOIS as the authoritative source on 28 January 2025; many ccTLDs and .com still answer WHOIS. Registrant identity is usually redacted, so the useful triage fields are creation date, registrar, name servers and status, not the owner.

In triage: a domain registered last week and pointed at a free host is a strong phishing signal.

Watch for: “attribution” from registration data rarely survives redaction and privacy services.

Operators: registries and registrars, under ICANN policy

Renamed 2025-01-28 formerly WHOIS Owner: Registries and registrars, under ICANN policy Checked 2026-10-13 Source

Amazon Security Lake

AWS service that centralizes security logs (CloudTrail, VPC Flow Logs, Route 53, Security Hub findings and third-party sources) into an S3-based data lake normalized to OCSF.

In triage: long-retention, queryable history (Athena or a subscribed SIEM) when the SIEM’s hot window has rolled over.

Watch for: a data lake stores; it does not alert. Someone has to query it.

Vendor: Amazon Web Services · Also: OCSF

Cortex XSIAM

Palo Alto Networks’ SOC platform: SIEM-style ingestion, XDR analytics, built-in SOAR automation and attack-surface data on one data store. The migration path offered to former QRadar SaaS customers.

In triage: grouped incidents with the endpoint, network and cloud alerts behind them, queried with XQL.

Watch for: automatic grouping can merge unrelated alerts; check that every member belongs to the case.

Vendor: Palo Alto Networks · Also: Cortex XSOAR

Cribl

Data routing and processing for observability pipelines; filter, enrich, and reduce log data before forwarding.

In triage: explains why a field is missing or reshaped by the time it reaches the SIEM.

Watch for: cost-driven filtering rules can silently drop the events a detection needs.

Vendor: Cribl

Elastic Security

Unified security on the Elastic Stack; endpoint protection, prebuilt detections, and customizable monitoring.

In triage: alerts with their source documents, searched with KQL (Kibana), EQL sequences or ES|QL.

Watch for: Elastic’s KQL is the Kibana Query Language, not Microsoft’s Kusto.

Vendor: Elastic · Also: ES|QL and EQL, ECS

Exabeam

SIEM and user and entity behavior analytics (UEBA) vendor: risk-scored user and entity timelines and automated investigation. Merged with LogRhythm in July 2024; sells the cloud New-Scale platform and the self-hosted LogRhythm SIEM.

In triage: a per-user timeline with risk points for each anomalous event.

Watch for: a high risk score sums anomalies; it is not a finding that any one of them was malicious. “Advanced Analytics” and “Fusion” are pre-merger product names.

Vendor: Exabeam · Also: LogRhythm SIEM

Acquired 2024-07 Owner: Exabeam Checked 2026-10-13 Source

Fluentd

Open-source data collector that unifies log collection and processing across distributed systems via plugins.

In triage: common in Kubernetes logging; tells you how container logs reached the SIEM.

Watch for: buffer overflows and dropped chunks leave gaps that look like quiet periods.

Project: CNCF (open source)

Google Security Operations (formerly Chronicle)

Cloud-native security analytics platform from Google Cloud; high-speed search and threat detection at petabyte scale. Chronicle was folded into the Google Security Operations (Google SecOps) brand in 2024.

In triage: UDM search across long retention, with detections written in YARA-L 2.0.

Watch for: raw logs and UDM events can disagree when a parser mis-maps a field; check the raw log.

Vendor: Google Cloud · Formerly: Chronicle · Also: YARA-L 2.0 and UDM

Renamed formerly Chronicle Owner: Google Cloud Checked 2026-10-13 Source

IBM QRadar

Enterprise SIEM with real-time correlation, ML-assisted prioritization, and broad ecosystem integration. IBM sold its QRadar SaaS business to Palo Alto Networks (deal closed August 31, 2024); SaaS customers are offered migration to Cortex XSIAM, while QRadar on-premises deployments continue to receive IBM features and support.

In triage: offenses that group events by source, queried with AQL.

Watch for: an offense’s magnitude is QRadar’s own weighting, not your Risk rating.

Vendor: IBM (on-premises) · QRadar SaaS: Palo Alto Networks · Also: Cortex XSIAM

Acquired 2024-08-31 Owner: IBM (on-premises); Palo Alto Networks (QRadar SaaS) Successor: Cortex XSIAM, for former QRadar SaaS customers Checked 2026-10-13 Source

LogRhythm SIEM

Self-hosted SIEM with log normalization, correlation (AI Engine rules) and case management, now sold by Exabeam after the 2024 merger.

In triage: alarms built on normalized metadata fields, with the raw log attached.

Watch for: classification fields are assigned by parsing rules; a mis-parsed log lands in the wrong bucket.

Vendor: Exabeam · Formerly: LogRhythm

Acquired 2024-07 Owner: Exabeam Checked 2026-10-13 Source

Logstash

Server-side pipeline that ingests, transforms, and forwards data; the ‘L’ in the classic ELK stack. Still widely used but no longer required: Elastic now describes Elastic Agent with an integration as usually the simplest ingest path.

In triage: where grok patterns and filters reshape a log before it is indexed.

Watch for: a failed grok match tags the event and leaves fields empty, so searches on those fields miss it.

Vendor: Elastic

Microsoft Sentinel

Microsoft’s cloud SIEM/SOAR (formerly Azure Sentinel), built on Log Analytics and queried with KQL; playbooks run on Azure Logic Apps. Built-in UEBA and an optional lower-cost data lake tier. Now runs in the unified Microsoft Defender portal; Azure portal support ends 31 March 2027.

In triage: incidents and their entities, with KQL across SigninLogs, SecurityEvent, AuditLogs and the Defender tables.

Watch for: each table has its own retention, and data-lake-tier tables are queried differently from analytics-tier ones.

Vendor: Microsoft · Formerly: Azure Sentinel · Also: KQL

OpenText ESM (formerly ArcSight)

OpenText Enterprise Security Manager: the long-standing correlation-focused SIEM sold for years as ArcSight, common in compliance-driven shops. OpenText has owned it since its 2023 acquisition of Micro Focus. CEF, the Common Event Format, originated at ArcSight.

In triage: correlation-rule alerts and CEF-formatted events; older runbooks and many analysts still call it ArcSight.

Watch for: CEF fields are only as good as the device mapping that filled them.

Vendor: OpenText · Formerly: Micro Focus, HPE

Renamed 2023 formerly ArcSight Owner: OpenText Checked 2026-10-13 Source

Rapid7 InsightIDR

Rapid7’s cloud-delivered SIEM and XDR: log search, user and attacker behavior analytics, and built-in detections over ingested logs and the Rapid7 Insight Agent.

In triage: investigations that tie an alert to a user and an asset, with log search in LEQL (Log Entry Query Language).

Watch for: user-to-asset attribution is built from ingested authentication and DHCP logs; a gap in those sources pins the activity on the wrong user or host.

Vendor: Rapid7 · Also: Rapid7 InsightVM

SIEM (concept)

Aggregation and correlation of security event data for centralized detection, compliance, and IR.

In triage: the one place where firewall, identity, endpoint and application logs can be searched together.

Watch for: a SIEM sees only what was shipped to it; absence of a log is not absence of activity.

Category card · Full entry: C.L.E.A.R.

Splunk Enterprise Security

SIEM application on the Splunk platform: correlation searches, risk-based alerting, and prebuilt content for SOC workflows.

In triage: notable events and risk-event timelines, searched in SPL against CIM-normalized data models.

Watch for: data models accelerate only what is mapped to them; an unmapped source is invisible to CIM searches.

Vendor: Splunk, a Cisco company · Also: SPL, Splunk CIM

Acquired 2024-03-18 Owner: Cisco (Splunk) Checked 2026-10-13 Source

CrowdStrike Query Language (CQL)

The pipe-based query language of Falcon LogScale and Falcon’s Advanced Event Search.

In triage: hunt across Falcon sensor events (ProcessRollup2, DnsRequest, NetworkConnectIP4) beyond what the detection page shows.

Watch for: event and field names differ from Sysmon’s even when they describe the same thing.

Vendor: CrowdStrike

ECS

Elastic Common Schema: open field-naming specification (source.ip, process.command_line, user.name) used across Elastic data; contributed to OpenTelemetry semantic conventions.

In triage: the field names you search in Elastic Security.

Watch for: custom fields outside ECS do not appear in prebuilt rules or dashboards.

Steward: Elastic (open specification)

ES|QL and EQL

Elastic’s query languages: ES|QL is a piped query language for search and aggregation; EQL (Event Query Language) expresses ordered sequences of events.

In triage: EQL’s sequence queries find “process A, then network connection, then file write” on one host.

Watch for: sequence windows that are too short miss slow attackers.

Vendor: Elastic

KQL

Kusto Query Language: Microsoft’s piped, read-only query language for Sentinel, Defender XDR Advanced Hunting, Log Analytics and Azure Data Explorer.

In triage: one language across sign-in, endpoint, email and cloud tables in Microsoft estates.

Watch for: Advanced Hunting keeps 30 days by default; older data lives in Sentinel, if it was sent there.

Vendor: Microsoft

OCSF

Open Cybersecurity Schema Framework: vendor-neutral event schema (classes such as Authentication, Process Activity, Network Activity) adopted by Amazon Security Lake and many SIEM pipelines.

In triage: lets one query cover several vendors’ logs once they are normalized.

Watch for: normalization loses vendor-specific detail; keep a path back to the raw event.

Project: OCSF (open source, Linux Foundation)

Sigma

Open, vendor-neutral detection-rule format: write a detection once in YAML, convert it to the query language of whatever SIEM is in use. The de facto standard for sharing detection logic between teams and tools.

In triage: read the rule behind an alert to see exactly which fields and values fired it.

Watch for: conversion depends on field mappings; a rule that converts cleanly can still query a field your logs never populate.

Project: SigmaHQ (open source)

Sigma filter

A separate Sigma file that names one or more rules by ID and holds environment-specific conditions, usually exclusions, which the converter appends to each named rule’s condition at conversion. The shared rule file stays unedited, so upstream fixes still apply. Defined by the Sigma Filters Specification (v2.1.0, August 2025).

In triage: when a rule should have fired and did not, read the filters applied to it at conversion, not only the rule.

Watch for: a filter is an exception: it needs an owner, an expiry and a place in the exception register, and a broad one blinds the rule without anyone editing it.

Project: SigmaHQ (open source) · Also: Exception governance

SPL

Search Processing Language: Splunk’s piped search language for filtering, transforming and correlating indexed events.

In triage: pivot from a notable event to every raw event for the same user, host or IP.

Watch for: searches without an index and time range are slow and can time out, which looks like “no results”.

Vendor: Splunk, a Cisco company

Splunk CIM

Splunk Common Information Model: data models (Authentication, Endpoint, Network Traffic, Web) with standard field names that Enterprise Security content searches.

In triage: explains why an ES correlation search sees one source and not another.

Watch for: a source that is indexed but not CIM-mapped is invisible to data-model searches.

Vendor: Splunk, a Cisco company

YARA-L 2.0 and UDM

Google Security Operations’ detection language (YARA-L 2.0, unrelated to file-scanning YARA despite the name) and its Unified Data Model event schema.

In triage: read the rule’s event variables and match window to see what had to happen, in what order.

Watch for: UDM fields come from parsers; a parser gap leaves the field empty and the rule silent.

Vendor: Google Cloud

ETW (Event Tracing for Windows)

Windows’ kernel and user-mode tracing framework; many EDR sensors and Sysmon-like tools consume its providers.

In triage: explains where an EDR’s .NET, PowerShell or network events came from.

Watch for: attackers patch ETW inside their own process to blind user-mode providers; a host that goes quiet mid-incident is a signal.

Vendor: Microsoft (built into Windows)

Falco

Open-source runtime-security engine for containers, Kubernetes and Linux hosts; watches system calls (via eBPF) and raises alerts from rules.

In triage: “shell spawned in a container” and “sensitive file read” alerts with pod and image context.

Watch for: default rules are noisy on build and debug pods; check the namespace before escalating.

Project: CNCF (open source, created at Sysdig)

Linux auditd

The Linux Audit framework’s user-space daemon: records system calls (execve, connect), file watches and authentication events according to configured rules.

In triage: command execution with the login user (auid) preserved across sudo.

Watch for: coverage is whatever the rules say; many hosts run it with almost no rules.

Project: Linux Audit (open source)

osquery

Open-source agent that exposes operating-system state (processes, listening ports, users, startup items, browser extensions) as SQL tables on Windows, macOS and Linux.

In triage: ask a fleet “which hosts have this extension, service or file?”

Watch for: scheduled snapshots miss short-lived processes unless the event tables are enabled.

Project: osquery (Linux Foundation; originally Facebook)

Sysmon

Microsoft Sysinternals service that writes detailed endpoint telemetry (process creation with command lines, network connections, driver and DLL loads, file-time changes) to the Windows event log for SIEM ingestion. Now also a built-in optional feature on Windows 11 and Server 2025 (rendered messages are localized, so parse the XML); Sysmon for Linux exists too.

In triage: Event ID 1 (process create, with parent and hashes), 3 (network), 11 (file create) and 22 (DNS) build the process story.

Watch for: what it records depends entirely on its XML configuration; check the config before treating a missing event as proof.

Vendor: Microsoft (Sysinternals)

Tetragon

eBPF-based security observability and runtime enforcement for Linux and Kubernetes, from the Cilium project: process execution, file access and network events with workload identity.

In triage: a process tree tied to the pod and container that ran it.

Watch for: enforcement policies can kill processes; know whether a policy acted before you read “absence” as a clean host.

Project: Cilium (CNCF, open source)

Windows Security event IDs

The Windows event log records triage analysts cite most: 4624 and 4625 (logon success and failure), 4672 (special privileges), 4688 (process creation), 4698 (scheduled task created), 4720 (account created), 1102 (audit log cleared), 7045 (service installed, System log) and 4104 (PowerShell script block, PowerShell Operational log).

In triage: logon type, source address and process lineage straight from the host.

Watch for: 4688 carries a command line only if the “include command line” audit policy is on; many IDs need audit policy enabled first.

Vendor: Microsoft (built into Windows) · Also: C.L.E.A.R.: Windows Event Logs

Bitdefender GravityZone

EDR with behavior analysis, anti-exploit, root-cause analysis, and policy-based remediation.

In triage: incident graphs that show the root-cause process and what it touched.

Watch for: the root-cause node is the console’s best guess; walk the parent chain yourself.

Vendor: Bitdefender

Carbon Black

EDR and application-control line (Carbon Black Cloud, EDR and App Control), long known for unfiltered process and file-event recording.

In triage: full process trees with command lines, netconns and file modifications per host.

Watch for: the product line has changed owners twice (VMware, then Broadcom); confirm which console and version your team runs.

Vendor: Broadcom · Formerly: VMware Carbon Black

Acquired 2023-11 formerly VMware Carbon Black Owner: Broadcom Checked 2026-10-13 Source

CrowdStrike Falcon

Cloud-native EDR platform; combines behavioral analytics, threat intel, and ML on a single sensor.

In triage: process trees and detections, Advanced Event Search in CQL, Real Time Response for live collection, and one-click network containment.

Watch for: containment and RTR actions change the host; preserve what you need first and record what you ran.

Vendor: CrowdStrike · Also: CQL, Falcon Identity Protection

Cybereason

EDR/XDR focused on endpoint visibility, malware detection, IR, and deep process-tree forensics. Now part of LevelBlue; Cybereason research is being combined with LevelBlue SpiderLabs.

In triage: “MalOps” that group related process, network and file activity into one story.

Watch for: the brand is folding into LevelBlue; expect console and support names to change.

Vendor: LevelBlue (acquisition completed November 2025)

Acquired 2025-11-25 Owner: LevelBlue Checked 2026-10-13 Source

Cynet AutoXDR

XDR platform for small-to-mid SOCs combining endpoint, network and user analytics with automated investigation and remediation playbooks and a bundled MDR service; marketed as Cynet All-in-One.

In triage: automated investigation summaries and the remediation actions already taken.

Watch for: automatic remediation may have acted before you looked; read the action log first.

Vendor: Cynet · Formerly: Cynet 360 AutoXDR

Kaspersky Next EDR

Kaspersky’s endpoint detection and response line, formerly sold as Kaspersky EDR: attack-chain visualization, IOC search, sandboxing, and threat-intel integration with centralized management. The U.S. Commerce Department’s BIS Final Determination (June 2024) barred U.S. sales from July 20, 2024 and updates from September 29, 2024, so any Kaspersky agent still on a U.S. host is unpatched.

In triage: outside the U.S., its attack-chain graphs and IOC scans as with any EDR.

Watch for: on a U.S. host, a Kaspersky agent means stale signatures and an unpatched sensor.

Vendor: Kaspersky

Renamed 2024-04 formerly Kaspersky EDR Owner: Kaspersky Checked 2026-10-13 Source

Microsoft Defender

Microsoft’s security suite: Defender Antivirus, Defender for Endpoint (EDR), and Defender XDR, which correlates endpoint, identity (Defender for Identity), email (Defender for Office 365) and SaaS (Defender for Cloud Apps) signals into incidents in the Microsoft Defender portal; analysts hunt across the raw data with KQL in Advanced Hunting.

In triage: the incident graph, the device timeline, Live Response and device isolation.

Watch for: an incident’s grouping is automatic; confirm each alert belongs to the same case before closing them together.

Vendor: Microsoft · Formerly: Microsoft 365 Defender (XDR) · Also: KQL

Renamed formerly Microsoft 365 Defender Owner: Microsoft Checked 2026-10-13 Source

SentinelOne

Unified EPP/EDR with behavioral AI, autonomous response, rollback on Windows, and threat-hunting telemetry.

In triage: storyline views that tie a process tree together, with Deep Visibility hunting.

Watch for: an automatic kill or rollback may already have changed the host you are examining.

Vendor: SentinelOne · Also: Purple AI

Sophos Endpoint (formerly Intercept X)

Endpoint protection with deep-learning malware detection, anti-ransomware (CryptoGuard) and exploit prevention; Sophos EDR and Sophos XDR add investigation and cross-source detection. Sophos dropped the Intercept X name in late 2025.

In triage: threat-case graphs and, with EDR or XDR, live discovery queries.

Watch for: older documentation and SKUs still say Intercept X.

Vendor: Sophos · Formerly: Intercept X

Renamed 2025-10 formerly Intercept X Owner: Sophos Checked 2026-10-13 Source

Symantec Endpoint Security

Endpoint protection, email security, DLP, and EDR; global sensor network feeding detection and response.

In triage: endpoint detections and EDR process records in the Symantec console.

Watch for: Symantec’s management product is a separate card (Patch, config and integrity).

Vendor: Broadcom · Also: Symantec Endpoint Management

ThreatDown EDR (formerly Malwarebytes EDR)

EDR focused on remediation; ransomware rollback and post-infection cleanup. ThreatDown is Malwarebytes’ business brand.

In triage: detections with the remediation already applied and rollback options.

Watch for: remediation removes artifacts; collect them before cleaning.

Vendor: Malwarebytes · Formerly: Malwarebytes EDR

Renamed 2023 formerly Malwarebytes EDR Owner: Malwarebytes Checked 2026-10-13 Source

Trellix Endpoint Security

Part of the broader Trellix XDR; detection, investigation, and response with behavioral analytics and forensic timelines.

In triage: host timelines and detections inherited from the McAfee Enterprise and FireEye endpoint lines.

Watch for: estates often run both legacy agents during migration; check which one produced the alert.

Vendor: Trellix · Formerly: McAfee Enterprise and FireEye products

Renamed 2022-01 formerly McAfee Enterprise, FireEye Owner: Trellix Checked 2026-10-13 Source

TrendAI Vision One (formerly Trend Vision One)

XDR platform correlating telemetry across email, endpoint, server, and cloud workloads, plus exposure management. Trend Micro renamed its enterprise business TrendAI in March 2026.

In triage: workbench alerts that link endpoint and email events for one user.

Watch for: agent display names change by build, so posture checks may see two names for one product.

Vendor: TrendAI (Trend Micro) · Formerly: Trend Micro Vision One

Renamed 2026-03-24 formerly Trend Micro Vision One, Trend Vision One Owner: TrendAI (Trend Micro) Checked 2026-10-13 Source

XDR (concept)

Extended detection and response: correlates telemetry across endpoint, identity, email, network, and cloud into unified detections and response actions, extending EDR beyond the single host.

In triage: one incident across several sensors, with response actions in the same console.

Watch for: XDR covers what its vendor’s sensors and connectors feed it; firewall, SaaS and custom application logs usually still live in the SIEM.

Category card · Full entry: C.L.E.A.R.

Abnormal AI

API-based email security that models normal sender and recipient behavior to catch business email compromise, vendor fraud and account takeover in cloud mailboxes.

In triage: why a message was flagged (unusual sender relationship, tone, payment request) and whether it was auto-remediated.

Watch for: API tools act after delivery; a message may have been read before removal.

Vendor: Abnormal AI · Formerly: Abnormal Security

Renamed formerly Abnormal Security Owner: Abnormal AI Checked 2026-10-13 Source

Google Workspace security (Gmail)

Gmail’s built-in protections plus the Workspace security center and investigation tool, which search message, login and Drive events across the domain.

In triage: the investigation tool finds every recipient of a message and can delete it from all mailboxes.

Watch for: the investigation tool and log retention depend on the Workspace edition.

Vendor: Google

Message trace (concept)

The mail platform’s delivery log: sender, recipients, subject, message ID, timestamps and the verdict each filter gave a message.

In triage: scope a phish by finding every mailbox that received the same message ID or sender.

Watch for: trace shows delivery, not opening or clicking; click data comes from URL rewriting or the endpoint.

Category card

Microsoft Defender for Office 365

Microsoft’s email and collaboration protection for Exchange Online, Teams and SharePoint: Safe Links, Safe Attachments, anti-phishing policies, Threat Explorer and automated investigation.

In triage: Threat Explorer and the EmailEvents and UrlClickEvents tables show who received and who clicked.

Watch for: “zero-hour auto purge” may have removed a message after delivery; check the timeline, not just the current mailbox.

Vendor: Microsoft · Also: Microsoft Defender

Mimecast

Secure email gateway and email-security platform with URL and attachment protection, archiving and awareness training; also owns Incydr (insider risk).

In triage: message tracking, URL-protect click logs and held-message queues.

Watch for: rewritten URLs hide the original destination; decode before you assess it.

Vendor: Mimecast · Also: Mimecast Incydr

Proofpoint

Email security platform (gateway and API-based) with URL Defense, attachment sandboxing, TAP threat dashboards and automated retraction of delivered threats.

In triage: TAP shows which users were targeted and who clicked; message logs give delivery path.

Watch for: URL Defense rewrites links; a click record means the user clicked the wrapper, and the verdict may have changed since.

Vendor: Proofpoint · Also: Proofpoint Identity Threat Defense

Active Directory

Microsoft’s on-premises directory service: domains, users, groups, Group Policy and Kerberos/NTLM authentication for Windows estates.

In triage: domain controller security logs (4624, 4768, 4769, 4776) and group-membership changes (4728, 4732, 4756).

Watch for: each DC logs only what it handled; collect from every DC, not one.

Vendor: Microsoft

BeyondTrust

Privileged access management; just-in-time access, password vaulting, session monitoring, endpoint privilege management, and remote-support tooling.

In triage: vault checkouts and recorded sessions for a privileged account.

Watch for: its remote-support products are themselves internet-facing targets; patch status matters.

Vendor: BeyondTrust

BloodHound

Graph tool that maps attack paths through Active Directory and Entra ID (group memberships, sessions, ACLs, delegation) to privileged targets; free Community Edition and commercial Enterprise.

In triage: defenders use it to see how far a compromised account could reach.

Watch for: attackers run the same collectors (SharpHound); a burst of LDAP and session enumeration from a workstation is a classic signal.

Vendor: SpecterOps (open source CE)

CrowdStrike Falcon Identity Protection

CrowdStrike’s ITDR module, sold within Falcon Next-Gen Identity Security: monitors Active Directory and Entra ID authentication for credential misuse, privilege escalation and lateral movement, and can enforce MFA on risky logons.

In triage: per-account risk and the authentication traffic behind it, next to Falcon endpoint data.

Watch for: it sees what its domain-controller sensors and connectors see; unmonitored DCs are blind spots.

Vendor: CrowdStrike

CyberArk

Privileged access management: vaulting and rotating privileged credentials, session recording, secrets and machine-identity management. Acquired by Palo Alto Networks (February 2026); the platform is being rebranded Idira. In triage, its session recordings and vault checkout logs show who used a privileged credential and when.

In triage: match a privileged logon to a vault checkout; a privileged logon with no checkout is the finding.

Watch for: break-glass (emergency access) accounts often bypass the vault by design; check them separately.

Vendor: Palo Alto Networks (Idira)

Acquired 2026-02-11 Owner: Palo Alto Networks (Idira) Checked 2026-10-13 Source

Duo

MFA, device trust, and contextual access; widely used for remote access and SaaS protection.

In triage: authentication logs with factor, device, location and the push result.

Watch for: a run of denied pushes followed by one approval is MFA fatigue, not a user changing their mind.

Vendor: Cisco

Microsoft Defender for Identity

Microsoft’s ITDR sensor for Active Directory, AD FS and AD CS: detects reconnaissance, credential attacks (Kerberoasting, DCSync, pass-the-ticket) and lateral movement from domain-controller traffic.

In triage: identity alerts in Defender XDR and the IdentityLogonEvents and IdentityDirectoryEvents tables.

Watch for: coverage requires a sensor on every DC; one missing sensor is one missing view.

Vendor: Microsoft · Also: Microsoft Defender

Microsoft Entra ID (formerly Azure AD)

Microsoft’s cloud identity provider: SSO, MFA, Conditional Access. Triage evidence lives in the sign-in logs (interactive and non-interactive), audit logs, and Microsoft Entra ID Protection risk detections.

In triage: sign-in logs show IP, device, Conditional Access result and token type; audit logs show consent grants, MFA-method and role changes.

Watch for: sign-in logs are kept 7 days on Entra ID Free and 30 days on P1/P2 unless exported.

Vendor: Microsoft · Formerly: Azure Active Directory

Renamed 2023-07 formerly Azure Active Directory, Azure AD Owner: Microsoft Checked 2026-10-13 Source

Okta

Identity platform with SSO, MFA, lifecycle management, and federation across thousands of apps.

In triage: the System Log: sign-ins, MFA events, session and admin actions, with client IP and user agent.

Watch for: a stolen session cookie produces activity with no new sign-in event; look for one session used from two networks.

Vendor: Okta

One Identity

IGA with lifecycle management, role-based access control (RBAC) and privileged-access governance; unifies Active Directory, Microsoft Entra ID, and cloud-platform identities.

In triage: whether an account’s access was requested, approved and certified, and by whom.

Watch for: governance records intent; the directory records reality. Compare the two.

Vendor: One Identity

Ping Identity

Cloud-first identity for SSO, MFA, and customer IAM, across hybrid and multi-cloud estates. Both Ping and ForgeRock are owned by Thoma Bravo, which merged ForgeRock into Ping in 2023; ForgeRock’s lifecycle and governance products now ship under the Ping brand.

In triage: federation and authentication logs for workforce and customer sign-ins.

Watch for: customer-identity logs can dwarf workforce ones; filter by application before you scope.

Vendor: Ping Identity (Thoma Bravo) · Also: ForgeRock

PingCastle

Active Directory security assessment tool: scores a domain’s hygiene and lists risky configurations (stale admins, weak delegation, legacy protocols). Unrelated to Ping Identity.

In triage: a recent report tells you which AD weaknesses an intruder could already use.

Watch for: it is a point-in-time audit, not monitoring.

Vendor: Netwrix (acquired 2024; free edition remains)

Acquired 2024 Owner: Netwrix Checked 2026-10-13 Source

Proofpoint Identity Threat Defense (formerly Illusive)

Deception-based identity-threat detection. Plants fake credentials and decoy paths to surface attacker lateral movement. Illusive Networks acquired by Proofpoint, 2022.

In triage: any use of a planted credential is high-fidelity evidence of an intruder on that host.

Watch for: admin scripts that sweep credential stores can trip decoys; check the process first.

Vendor: Proofpoint · Formerly: Illusive Networks · Also: Deception

Acquired formerly Illusive Owner: Proofpoint Checked 2026-10-13 Source

SailPoint

Identity governance with least-privilege enforcement, access reviews, and ML-driven anomaly detection.

In triage: joiner, mover and leaver history for an account, and who certified its access.

Watch for: a terminated user’s still-active account is a governance failure worth its own ticket.

Vendor: SailPoint

Silverfort

Identity security platform that sits in the authentication path of Active Directory and other IdPs to add MFA and policy to protocols that lack it, including service accounts and legacy systems.

In triage: authentication records for NTLM and Kerberos traffic other tools do not see.

Watch for: service-account policies in learning mode alert but do not block.

Vendor: Silverfort

Amazon CloudWatch

Monitoring and observability for AWS resources and applications; metrics, logs, alarms, automation hooks.

In triage: application and Lambda logs, and alarms on metric spikes such as sudden egress.

Watch for: CloudWatch is the operations layer, not the audit record of who called which API.

Vendor: Amazon Web Services · Also: AWS CloudTrail

Amazon GuardDuty

AWS-native threat detection; analyzes CloudTrail management events, VPC Flow Logs, and Route 53 Resolver DNS logs (plus optional protection plans) to raise findings. A detection layer, not the audit record.

In triage: findings name the principal, resource and finding type; pivot to CloudTrail for the calls themselves.

Watch for: GuardDuty does not know your baseline; “unusual” means unusual to its model, not to your pipeline.

Vendor: Amazon Web Services

AWS CloudTrail

Records API activity in an AWS account: the audit trail for security and forensic work. Management events are on by default (90 days in Event history); data events such as S3 object reads and Lambda invokes must be enabled on a trail or event data store.

In triage: who called which API, from which IP and user agent, with sourceIdentity for role-chain attribution.

Watch for: data events are off by default; Event history keeps 90 days of management events only, per Region.

Vendor: Amazon Web Services

AWS Security Hub

AWS service that aggregates findings from GuardDuty, Inspector, Macie and partner tools and runs posture checks against security standards across accounts.

In triage: one place to see every finding on a resource across an AWS Organization.

Watch for: it aggregates; open the producing service for detail.

Vendor: Amazon Web Services

AWS VPC Flow Logs

Per-interface records of accepted and rejected IP traffic in a VPC: addresses, ports, protocol, bytes, packets and action. The cloud’s NetFlow.

In triage: did that instance actually talk to the suspicious address, and how much did it send?

Watch for: flow logs must be enabled per VPC, subnet or interface, and they carry no payload or DNS names.

Vendor: Amazon Web Services · Also: NetFlow

Azure Activity Log

Azure’s subscription-level control-plane log: who created, changed or deleted which resource, and role assignments.

In triage: the Azure counterpart of CloudTrail management events.

Watch for: kept 90 days unless exported; data-plane activity (storage reads, Key Vault access) needs resource diagnostic logs.

Vendor: Microsoft

CNAPP, CSPM and CDR (concept)

Cloud security categories: CSPM checks configuration against policy, CDR detects live threats in cloud control planes and workloads, and a CNAPP combines them with workload protection and code scanning.

In triage: CSPM tells you whether the targeted resource was exposed; CDR tells you whether someone used it.

Watch for: a posture finding is a condition, not an event; it does not mean anyone exploited it.

Category card · Also: Uncover: tool families

Cortex Cloud (formerly Prisma Cloud)

Palo Alto Networks’ CNAPP plus cloud detection and response (CDR): posture management, IaC scanning, workload runtime protection and cloud threat detection on the Cortex platform. Launched in 2025 as the next generation of Prisma Cloud; existing Prisma Cloud customers are being upgraded to it.

In triage: posture context and runtime alerts for the workload in the case.

Watch for: both names appear in consoles and documentation during the upgrade.

Vendor: Palo Alto Networks · Formerly: Prisma Cloud

Renamed 2025 formerly Prisma Cloud Owner: Palo Alto Networks Checked 2026-10-13 Source

Google Cloud Audit Logs

Google Cloud’s Admin Activity, Data Access, System Event and Policy Denied logs: who did what to which resource.

In triage: the GCP counterpart of CloudTrail, queried in Cloud Logging.

Watch for: Data Access logs are off by default for most services (BigQuery is the main exception).

Vendor: Google Cloud

Google Security Command Center

Google Cloud’s native security and risk platform: misconfiguration and vulnerability findings, threat detection (Event Threat Detection, Container Threat Detection) and attack-path simulation.

In triage: GCP-native findings with the affected resource and project.

Watch for: tiers differ widely in what they detect; know which one is licensed.

Vendor: Google Cloud

Microsoft Defender for Cloud

Microsoft’s CNAPP: posture management and workload protection plans (servers, containers, storage, databases) across Azure, AWS and GCP.

In triage: workload alerts that flow into Defender XDR incidents.

Watch for: protection is per plan and per subscription; an unprotected subscription raises nothing.

Vendor: Microsoft

Orca Security

Agentless cloud security; full-stack visibility, vulnerability management, and risk prioritization across cloud workloads.

In triage: what software and secrets sat on a workload, from snapshot scanning.

Watch for: agentless scans are periodic snapshots, not live process data.

Vendor: Orca Security

Sysdig

Cloud-native security focused on container runtime, Kubernetes monitoring, and cloud workload protection.

In triage: runtime alerts (Falco-based) with container, pod and image context.

Watch for: containers are short-lived; capture what you need before the pod is rescheduled.

Vendor: Sysdig · Also: Falco

Wiz

Agentless cloud security platform; correlates infra/config/workload data to map attack paths and prioritize risk. Now part of Google Cloud (acquisition completed March 2026). Wiz Defend adds runtime threat detection and response for cloud workloads.

In triage: the security graph shows whether a compromised workload had a path to sensitive data.

Watch for: an attack path is a possibility; whether anyone walked it needs audit logs.

Vendor: Google Cloud (Wiz keeps its brand)

Acquired 2026-03-11 Owner: Google Cloud Checked 2026-10-13 Source

Arkime

Open-source full-packet-capture indexing and search system (formerly Moloch): stores PCAP and session metadata so analysts can search and pull the exact packets of a session.

In triage: retrieve the actual bytes of a suspicious session, not just its summary.

Watch for: full capture fills storage fast; retention may be days, so pull what you need early.

Open source · Formerly: Moloch

Renamed 2020-11 formerly Moloch Owner: Open source Checked 2026-10-13 Source

Cisco Umbrella

Cloud-delivered DNS-layer security; blocks malicious domains at resolution time and logs every lookup per identity. Now sold as part of Cisco Secure Access; Cisco has announced end of life for the standalone Umbrella SIG and DNS offers.

In triage: which host or user resolved a domain, when, and whether the lookup was blocked.

Watch for: DNS logs show the lookup, not whether a connection followed; check proxy or flow data.

Vendor: Cisco · Also: Cisco Secure Access

Cloudflare One

Cloudflare’s SSE platform: secure web gateway, zero-trust network access, cloud access security broker (CASB) and DNS filtering delivered from its edge network.

In triage: Gateway HTTP and DNS logs and Access logs show what a user reached and through which policy.

Watch for: log retention and full HTTP logging depend on plan; export to the SIEM for history.

Vendor: Cloudflare

Corelight

Commercial NDR built on Zeek and Suricata: sensors produce Zeek logs and Suricata alerts, plus detections and smart PCAP.

In triage: conn, dns, http, ssl and files logs that answer “what did this host talk to?”

Watch for: it sees only the segments where sensors sit; east-west traffic is often unmonitored.

Vendor: Corelight · Also: Zeek, Suricata

Darktrace

Network detection and response vendor (also email, cloud, and OT) whose Behavioral Defense Platform models per-device and per-user behavior to flag anomalies; its autonomous response capability (originally branded Antigena) can block connections on its own. Treat its model-breach alerts as anomaly detections that need corroboration.

In triage: model-breach details list the devices, connections and the behavior that broke the model.

Watch for: autonomous response may already have blocked traffic, which changes what you can observe next.

Vendor: Darktrace (privately held by Thoma Bravo since 2024)

ExtraHop

NDR platform (RevealX) that decodes protocols from network traffic, including decrypting some enterprise protocols, to detect threats and record transactions.

In triage: protocol-level records (SMB file access, LDAP queries, database transactions) for a device.

Watch for: decryption coverage depends on key sharing configured by the network team.

Vendor: ExtraHop

Fortinet FortiGate

Next-generation firewall (NGFW) family with IPS, web filtering, VPN and application control, managed through FortiOS.

In triage: traffic, UTM and VPN logs: allowed and denied sessions, application IDs and remote-access sign-ins.

Watch for: FortiGate SSL-VPN and management interfaces have been repeatedly exploited; an internet-facing appliance is itself an asset to scope.

Vendor: Fortinet

NetFlow

Cisco’s flow-export format: per-connection metadata (5-tuple, bytes, packets, timestamps) without payloads. Standardized as IPFIX (RFC 7011); cloud equivalents are AWS VPC Flow Logs, Azure VNet flow logs and GCP VPC Flow Logs.

In triage: confirm whether two hosts talked, for how long and how much data moved.

Watch for: routers often sample flows (1 in N packets), so small transfers can be missing.

Origin: Cisco · Also: sFlow, AWS VPC Flow Logs

Netskope

SSE platform combining secure web gateway, CASB, zero-trust network access and inline DLP for web and SaaS traffic.

In triage: per-user web and SaaS activity, including instance-level detail (personal vs corporate cloud storage).

Watch for: traffic that bypasses the client (unmanaged devices, steering exceptions) is invisible.

Vendor: Netskope

NIDS (concept)

Network intrusion detection: inspects traffic for signatures, protocol anomalies, and behavioral indicators.

In triage: a rule hit names the signature, the flow and often the payload snippet that matched.

Watch for: a signature match says the traffic looked like an attack, not that the attack worked.

Category card · Full entry: C.L.E.A.R.

Palo Alto Networks NGFW

Next-generation firewalls (PA-Series, VM-Series) with App-ID, User-ID, threat prevention and URL filtering, managed by PAN-OS and Strata Cloud Manager.

In triage: traffic, threat and URL logs tie a session to an application and, with User-ID, to a user.

Watch for: GlobalProtect portals and management interfaces are frequent targets; check the appliance itself.

Vendor: Palo Alto Networks

RITA

Open-source tool (Real Intelligence Threat Analytics) that analyzes Zeek logs to find beaconing, long connections, DNS tunneling and threat-intel matches.

In triage: a ranked list of hosts with regular, beacon-like connections.

Watch for: update checkers and telemetry agents beacon too; confirm the destination before you call it C2.

Vendor: Active Countermeasures (open source)

Security Onion

Free platform for network security monitoring and log management: Zeek metadata, Suricata alerts and full packet capture behind one console, with Elastic for search. An Import installation replays a packet capture through Zeek and Suricata and keeps its original timestamps.

In triage: pivot from a Suricata alert to the Zeek logs and the packets for the same connection.

Watch for: it sees only the segments its sensors tap; on an imported capture, set the time range to the capture, not to today.

Vendor: Security Onion Solutions · Elastic License 2.0 · Also: Labs

Snort

Open-source NIDS/IPS with deep packet inspection (Snort 3 is the current major version). Rules come in three tiers distributed by Cisco Talos: a free Community set (a subset of the subscriber rules), a Registered set (free sign-up, delayed release), and a paid Subscriber set.

In triage: the rule SID and message name what matched; look the SID up to read the rule logic.

Watch for: which rule tier you run decides how current your detections are.

Vendor: Cisco (Talos)

Suricata

Open-source NIDS/IPS with multi-threaded inspection, file extraction, TLS handshake logging (SNI, certificates, JA3/JA4; no decryption), and EVE JSON output. Maintained by OISF.

In triage: EVE alert, flow, dns, http and tls records share a flow ID, so one alert pivots to the whole session.

Watch for: it does not decrypt TLS; payload rules only fire on cleartext.

Maintainer: Open Information Security Foundation (OISF)

Vectra AI

NDR and identity-threat detection platform that scores attacker behaviors across network, Entra ID, Microsoft 365 and AWS control planes.

In triage: prioritized host and account entities with the detections that raised their score.

Watch for: a score is an aggregate; read each underlying detection before acting.

Vendor: Vectra AI

Wireshark

Open-source packet analyzer; deep protocol decoding for investigation and forensics.

In triage: open a PCAP, follow a stream and export the objects it carried.

Watch for: opening untrusted captures has exploited dissector bugs before; analyze in an isolated VM.

Open source · Also: tshark (command line)

Zeek (formerly Bro)

Behavior-focused network monitoring producing structured session logs for SIEM-friendly analytics.

In triage: conn.log, dns.log, http.log, ssl.log and files.log, joined by the connection UID.

Watch for: Zeek records what happened, not whether it was bad; it pairs with a NIDS or RITA for detection.

Open source

Renamed 2018-10 formerly Bro Owner: Open source Checked 2026-10-13 Source

Zscaler Internet Access

Zscaler’s cloud secure web gateway: inline proxy with TLS inspection, URL filtering, sandboxing, firewall and DLP for user traffic.

In triage: web transaction logs give the full URL, user, policy action and threat verdict.

Watch for: TLS-inspection bypass lists (banking, health, pinned apps) leave those sessions as hostname only.

Vendor: Zscaler

Forcepoint

DLP, cloud security, and insider-threat behavior analytics across endpoints, networks, and cloud apps; sold as Risk-Adaptive Protection.

In triage: DLP incidents with the matched policy, destination and file.

Watch for: a risk score raises attention; it is not a finding about the person.

Vendor: Forcepoint

Fortra DLP (formerly Digital Guardian)

Fortra’s data loss prevention and endpoint data protection, sold as Digital Guardian until Fortra acquired the company in 2023: context-aware policies for data usage across endpoints, networks and cloud.

In triage: endpoint events that show a file’s path from classification to copy, upload or print.

Watch for: policy-only deployments log without blocking; an event is not proof the data left.

Vendor: Fortra

Renamed 2023 formerly Digital Guardian Owner: Fortra Checked 2026-10-13 Source

Mimecast Incydr (formerly Code42 Incydr)

Insider-risk and data-exfiltration detection across endpoint, cloud, email and browser; flags sensitive files moving to personal cloud storage, file-sharing sites or unsanctioned GenAI tools. Code42 was acquired by Mimecast in 2024 and Incydr is now a Mimecast product.

In triage: file-movement events per user, with destination and file metadata.

Watch for: departing-employee watchlists are set by the insider-risk route, not by the analyst.

Vendor: Mimecast · Formerly: Code42

Acquired formerly Code42 Incydr Owner: Mimecast Checked 2026-10-13 Source

Censys

Internet-wide asset discovery via continuous scanning; SSL/TLS, services, and attack-surface monitoring.

In triage: what services and certificates an external IP or domain exposed, and since when.

Watch for: scan data can be days old; confirm current exposure before you report it.

Vendor: Censys

Lansweeper

IT asset discovery and inventory; CMDB foundations and continuous visibility into devices, software, and users.

In triage: who owns a host, what it runs and when it was last seen.

Watch for: an asset missing from inventory is a finding in itself.

Vendor: Lansweeper

Microsoft Defender EASM

External attack surface management: discovers and monitors internet-facing assets, third-party services and shadow IT. Built on technology from RiskIQ (Microsoft acquired RiskIQ in 2021) and integrated with Microsoft Security Exposure Management.

In triage: whether an attacked host or domain is a known, owned, internet-facing asset.

Watch for: discovery is inferred from seeds; confirm ownership before acting on an unfamiliar asset.

Vendor: Microsoft · Formerly: RiskIQ

Qualys

Cloud-based vulnerability management, policy compliance, and web app scanning across enterprise estates.

In triage: open vulnerabilities on the target host, with detection date and agent or scanner source.

Watch for: unauthenticated scans miss local flaws; check the scan type.

Vendor: Qualys · Also: Qualys Patch Management

Rapid7 InsightVM / Nexpose

Rapid7’s vulnerability management: Nexpose is the on-premises scanner, and InsightVM is the Insight-platform product built on it, with exploitability-based prioritization; pairs with Metasploit. Rapid7 now also sells Exposure Command.

In triage: per-asset vulnerability and risk scores, plus whether a public exploit exists.

Watch for: a risk score reflects exploitability, not whether this activity is malicious.

Vendor: Rapid7 · Also: Rapid7 InsightIDR

Shodan

Search engine for internet-connected devices; identifies exposed services, outdated software, ICS, IoT.

In triage: what an external IP was exposing, including banners and software versions.

Watch for: attackers use the same index to pick targets.

Vendor: Shodan

Tenable

Vulnerability management vendor whose Nessus scanner underpins Tenable Vulnerability Management (cloud), Tenable Security Center (on-premises) and the Tenable One exposure platform.

In triage: plugin findings on the target host, with first-seen dates and exploit availability.

Watch for: credentialed and uncredentialed scans report very different results for the same host.

Vendor: Tenable · Also: Nessus, Tenable One

Cortex XSOAR

Palo Alto Networks’ SOAR (formerly Demisto, acquired 2019): case management, threat-intel management, playbook automation, and 900+ prebuilt integration packs. Palo Alto now markets Cortex AgentiX as its next generation (AI-agent automation), and SOAR is also built into Cortex XSIAM.

In triage: the incident war room shows every playbook task, command and result.

Watch for: a playbook that “closed” a case still needs a human-recorded disposition unless the pattern is governed for machine close.

Vendor: Palo Alto Networks · Formerly: Demisto · Also: Cortex XSIAM, Cortex AgentiX

Google Security Operations SOAR (formerly Siemplify / Chronicle SOAR)

SOAR with case management, playbooks, and analyst dashboards; integrated with Google SecOps (Chronicle) telemetry. Siemplify acquired by Google, 2022; fully integrated into Google SecOps.

In triage: cases group related alerts by entity, with playbook actions logged on the case wall.

Watch for: automatic alert grouping may merge unrelated alerts; check each one belongs.

Vendor: Google Cloud · Formerly: Siemplify

Acquired 2022-01 formerly Siemplify, Chronicle SOAR Owner: Google Cloud Checked 2026-10-13 Source

ServiceNow SecOps

ITSM and security workflow with ticketing, change management, CMDB integration, and security automation.

In triage: security incidents linked to the CMDB record and to change tickets that may explain the activity.

Watch for: a change ticket explains activity only if its scope and window actually match.

Vendor: ServiceNow

SOAR (concept)

Security orchestration, automation, and response: define, automate, and orchestrate IR workflows at scale.

In triage: enrichment arrives before you open the case, and routine actions run from a playbook.

Watch for: a playbook that ran is not a playbook that succeeded; check each step’s result.

Category card · Full entry: C.L.E.A.R.

Splunk SOAR (formerly Splunk Phantom)

SOAR with Python-based playbooks, 300+ integrations, and deep Splunk analytics ties. Phantom acquired by Splunk in 2018 and renamed Splunk SOAR in 2021; Splunk itself acquired by Cisco, 2024.

In triage: container (case) history with every action and its output.

Watch for: failed actions can be silent in summaries; open the action log.

Vendor: Cisco (Splunk) · Formerly: Phantom

Acquired 2024-03-18 formerly Splunk Phantom Owner: Cisco (Splunk) Checked 2026-10-13 Source

Sumo Logic Cloud SOAR (formerly DFLabs IncMan)

SOAR with playbooks, threat-intel enrichment, KPI tracking, and human-in-the-loop decisions. DFLabs acquired by Sumo Logic, 2021.

In triage: incident records with enrichment results and the analyst decisions taken.

Watch for: KPI dashboards reward closing fast; the record still has to support the verdict.

Vendor: Sumo Logic · Formerly: DFLabs

Acquired 2021-05 formerly DFLabs IncMan Owner: Sumo Logic Checked 2026-10-13 Source

Swimlane Turbine

Swimlane’s low-code security automation platform for building case-management and response workflows without deep programming expertise.

In triage: case records and workflow runs that show what was enriched and actioned.

Watch for: low-code workflows are still code; changes need review and version history.

Vendor: Swimlane

Renamed formerly Swimlane Owner: Swimlane Checked 2026-10-13 Source

TheHive

TheHive: collaborative case management for IR. Since v5 it is proprietary (StrangeBee) with a free, quota-limited Community license; open-source TheHive 4 reached end of support December 2022. Integrates with Cortex (StrangeBee’s observable-analysis engine, unrelated to Palo Alto Cortex) and MISP.

In triage: cases with tasks, observables and analyzer results in one place.

Watch for: an unpatched TheHive 4 instance is unsupported software holding case data.

Vendor: StrangeBee · Formerly: TheHive Project · Also: MISP

Tines

No-code automation built for security teams; modular “stories” for alert ingestion, enrichment, and response.

In triage: story run events show each enrichment call and its response.

Watch for: stories that call external APIs send indicators off-site; check what each one shares.

Vendor: Tines

AI SOC agents (concept)

Software agents that take an alert, gather context through connected tools, and propose or record a verdict without an analyst driving each step.

In triage: a first-pass investigation and a drafted rationale to check.

Watch for: an agent’s confidence is not evidence; verify the queries it ran and the data it saw.

Category card · Also: AI-assisted triage

Cortex AgentiX

Palo Alto Networks’ agentic automation platform, positioned as the next generation of Cortex XSOAR: AI agents that plan and run security workflows with human approval points.

In triage: agent-run investigations with the tool calls and approvals recorded.

Watch for: check which actions an agent may take without approval before you trust a closed case.

Vendor: Palo Alto Networks · Also: Cortex XSOAR

CrowdStrike Charlotte AI

CrowdStrike’s generative-AI assistant and agentic triage in the Falcon platform: answers questions in natural language, writes queries and triages detections.

In triage: detection triage verdicts and natural-language hunting over Falcon data.

Watch for: it reasons over Falcon data only; context outside the platform is missing from its answer.

Vendor: CrowdStrike

Gemini in Security Operations

Google’s generative-AI assistance inside Google Security Operations: natural-language search, case summaries, detection authoring and agentic alert triage.

In triage: converts a question into UDM search and summarizes a case.

Watch for: read the generated query; a wrong field or time range answers a different question.

Vendor: Google Cloud · Also: Google Security Operations

Microsoft Security Copilot

Microsoft’s generative-AI security assistant, embedded in Defender, Entra, Intune and Purview and available standalone, with agents for phishing triage and other tasks.

In triage: incident summaries, script analysis and KQL drafts inside the Defender portal.

Watch for: it acts with the signed-in user’s permissions; what it can read, a prompt injection can try to reach.

Vendor: Microsoft

SentinelOne Purple AI

SentinelOne’s generative-AI analyst assistant: natural-language hunting, investigation summaries and agentic triage in the Singularity platform.

In triage: converts questions into queries over Singularity data and drafts case notes.

Watch for: a summary can drop the one event that changes the verdict; check the raw results.

Vendor: SentinelOne

Arctic Wolf

MDR provider with its own Aurora platform and a named “concierge” security team per customer.

In triage: provider tickets with their investigation notes and recommended actions.

Watch for: agree in advance which containment actions the provider may take without asking.

Vendor: Arctic Wolf

eSentire

MDR provider with 24/7 SOC analysts, threat hunting and incident response across endpoint, network, log and cloud sources.

In triage: escalations that state what was isolated and why.

Watch for: an MDR sees only the sources it was onboarded to.

Vendor: eSentire

Expel

MDR provider that works in the customer’s own security tools through API integrations, with transparent investigation timelines in its Workbench.

In triage: the investigation timeline shows each question the provider asked and answered.

Watch for: remediation steps it recommends may fall to your team to execute.

Vendor: Expel

Falcon OverWatch

Managed threat-hunting service on top of CrowdStrike Falcon; 24/7 human-led analysis to validate stealthy intrusions.

In triage: OverWatch-sourced detections carry hunter notes on why the activity was flagged.

Watch for: hunting is not response; check whether your contract also includes Falcon Complete MDR.

Vendor: CrowdStrike · Also: CrowdStrike Falcon

Huntress

MDR provider focused on small and mid-sized businesses and managed service providers, covering endpoint, identity (Microsoft 365) and SIEM.

In triage: incident reports with remediation steps, some applied automatically.

Watch for: auto-remediation removes artifacts; ask what was collected first.

Vendor: Huntress

Red Canary

MDR provider known for detection engineering and its annual Threat Detection Report; also maintains Atomic Red Team. Acquired by Zscaler (completed August 2025).

In triage: detection timelines with the analyst’s narrative of what happened.

Watch for: service scope and integrations may change as it folds into Zscaler.

Vendor: Zscaler · Also: Atomic Red Team

Acquired 2025-08-01 Owner: Zscaler Checked 2026-10-13 Source

Autopsy

Open-source forensics platform on The Sleuth Kit; timeline analysis, keyword search, file carving, media analysis.

In triage: browse a disk image’s file system, web history and recent-file artifacts without commercial licenses.

Watch for: ingest modules are slow on large images; target the artifacts you need.

Open source (Basis Technology)

Belkasoft X Forensic (also known as Belkasoft Evidence Center X)

DFIR suite for computer, mobile, drone, vehicle and cloud forensics; parses encrypted containers and RAM dumps.

In triage: one case file that combines a laptop image, a phone extraction and a memory dump.

Watch for: parsed artifacts are interpretations; verify key findings against the raw source.

Vendor: Belkasoft

Renamed formerly Belkasoft Evidence Center X Owner: Belkasoft Checked 2026-10-13 Source

Cellebrite

Mobile-device extraction and analysis suite (Inseyets, which includes UFED) covering a wide range of phones and apps.

In triage: rarely in the SOC itself; it is how a forensics team answers what happened on a phone.

Watch for: mobile extraction usually needs legal and HR sign-off; request it through the investigation route.

Vendor: Cellebrite

Chainsaw

Open-source command-line tool that hunts through Windows event logs (EVTX) and other artifacts with Sigma rules and built-in detections.

In triage: run Sigma rules against logs pulled from a host that never shipped them to the SIEM.

Watch for: it finds only what the rules describe, and cleared logs leave gaps.

Vendor: WithSecure (open source) · Also: Sigma, Hayabusa

DFIR ORC

Open-source Windows forensic-artifact collector from ANSSI (France’s national cyber agency); gathers a configurable artifact set for offline post-compromise analysis.

In triage: a repeatable, signed collection of registry, event log, NTFS and memory artifacts from a host.

Watch for: collections can be large; agree the artifact set before running it fleet-wide.

Maintainer: ANSSI · Also: KAPE, Velociraptor

Hayabusa

Open-source Windows event-log fast-forensics timeline generator and threat-hunting tool that applies Sigma-based rules to EVTX files.

In triage: a CSV or JSON timeline of noteworthy events from one host’s logs, sorted and scored.

Watch for: severity levels come from the rules; tune before treating “high” as a verdict.

Maintainer: Yamato Security (open source) · Also: Chainsaw

KAPE

Kroll Artifact Parser and Extractor: a free-to-download triage tool (Kroll sells an enterprise license for commercial use on client engagements) that collects and parses forensic artifacts from a live system in minutes. A staple for fast evidence capture before (or instead of) full disk imaging.

In triage: targets and modules collect and parse the artifacts that answer “what ran here?”

Watch for: collection from a live host changes some timestamps; record what you ran and when.

Vendor: Kroll

Magnet AXIOM

Forensics across computers, mobile, cloud and IoT; artifact parsing and cross-source correlation in one case.

In triage: connections view links a file, a user and an app across devices.

Watch for: parsed artifacts are interpretations; check the source location before you cite one.

Vendor: Magnet Forensics

MSAB

Mobile forensics for law enforcement; XRY for extraction, XAMN for evidence visualization, XEC for lab management.

In triage: as with Cellebrite, a forensics-team tool rather than a SOC console.

Watch for: the same legal and approval gates apply before any phone is examined.

Vendor: MSAB

OpenText Forensic (formerly EnCase Forensic)

Long-standing digital-investigation suite, sold as EnCase Forensic until OpenText’s rebrand; acquisition, indexing, analysis, and court-ready reporting. Its E01 (EnCase evidence file) image format remains widely supported across forensic tools.

In triage: E01 images from it open in most other tools, so you can examine its acquisitions elsewhere.

Watch for: “court-ready” describes reports; admissibility is decided by courts and depends on your handling.

Vendor: OpenText · Formerly: EnCase Forensic

Renamed formerly EnCase Forensic Owner: OpenText Checked 2026-10-13 Source

Oxygen Forensic Detective

Mobile, cloud, drone, and IoT forensics with deep parsing of app data including secure messengers.

In triage: cloud-account extraction (with credentials or tokens) when the phone itself is unavailable.

Watch for: using a user’s cloud tokens needs explicit authorization.

Vendor: Oxygen Forensics

plaso

Open-source engine behind log2timeline; parses disk images and artifacts from many sources into a single super-timeline. The standard tooling for timeline-based forensic analysis.

In triage: one sorted timeline across file system, registry, browser and event-log artifacts.

Watch for: super-timelines are huge; filter to the window your alert defines.

Open source

Velociraptor

Open-source endpoint-visibility and DFIR platform (stewarded by Rapid7); hunts for and collects artifacts across entire fleets using its VQL query language. Also abused by intruders (2025 ransomware cases deployed it for remote access), so an unsanctioned Velociraptor install or server is itself suspicious.

In triage: run one artifact collection across thousands of hosts and get results in minutes.

Watch for: a Velociraptor client talking to a server your team does not run is an intrusion indicator, not a DFIR tool.

Steward: Rapid7 (open source) · Also: Dual-use tools

Volatility

Open-source memory-forensics framework; extracts processes, network connections, injected code, and credentials from RAM captures. Volatility 3 is the current generation.

In triage: find hidden or injected processes and live connections that disk artifacts never show.

Watch for: memory must be captured before containment or reboot; afterwards it is gone.

Maintainer: Volatility Foundation

X-Ways Forensics

Lightweight, fast forensic suite with scripting and hex-level analysis for deep investigations.

In triage: fast keyword and file-type searches across large images.

Watch for: its interface assumes forensic training; results need a trained examiner to interpret.

Vendor: X-Ways Software Technology

Any.Run

Interactive malware sandbox with behavioral and network analysis. Free-tier submissions and reports are public; use a private plan or an internal sandbox (CAPEv2) for anything from a targeted intrusion or containing internal data.

In triage: click through a lure in a live VM and watch process, network and file activity as it happens.

Watch for: evasive samples detect sandboxes and behave; a clean run is not a clean verdict.

Vendor: ANY.RUN

Atomic Red Team

Open-source library of small, ATT&CK-mapped tests that reproduce individual techniques so teams can check whether detections fire.

In triage: an alert from a scheduled atomic test is authorized activity; confirm it against the test schedule.

Watch for: attackers copy the same commands; a matching command line alone does not make it a test.

Maintainer: Red Canary (open source)

Boss of the SOC (BOTS)

Splunk’s blue-team capture-the-flag event and its public datasets: pre-indexed Splunk data from a fictional company, with questions answered by searching it. Version 3 (March 2020) covers Windows, network, AWS and Microsoft 365 telemetry and is released under CC0.

In triage: practice a triage question on data whose truth is known; this site’s Risk lab uses BOTS v3.

Watch for: BOTS v3 pins a 2018-era Splunk release; run it only on an isolated lab network.

Publisher: Splunk · Also: Labs

CAPEv2

Open-source automated malware sandbox descended from Cuckoo, with payload extraction (unpacked binaries, configs) and anti-evasion work; self-hosted, so samples stay in house.

In triage: the private option for detonating samples from a targeted intrusion.

Watch for: running it well means maintaining VMs and signatures; a stale guest image misses modern behavior.

Open source

Cisco Secure Malware Analytics (formerly Threat Grid)

Cloud sandbox combining behavior analysis with threat intelligence for advanced-malware investigation.

In triage: behavioral indicators and a threat score for a sample, often submitted automatically by Cisco security products.

Watch for: check whether your tenant’s submissions are private before sending sensitive files.

Vendor: Cisco · Formerly: Threat Grid

Renamed formerly Threat Grid Owner: Cisco Checked 2026-10-13 Source

Commvault Threatwise (formerly TrapX)

Deception and threat detection with decoys across endpoints, networks, and cloud. TrapX Security acquired by Commvault, 2022; rebranded as Threatwise.

In triage: any touch on a decoy is a high-fidelity sign of someone exploring the network.

Watch for: vulnerability scanners and inventory tools touch decoys too; exclude them deliberately, not by habit.

Vendor: Commvault · Formerly: TrapX Security

Acquired 2022-01 formerly TrapX Owner: Commvault Checked 2026-10-13 Source

Cuckoo Sandbox

Open-source automated malware analysis running suspect files in VMs and capturing behavior. The original project’s final release was 2.0.7 (2019) and it is no longer maintained; community successors (CAPEv2, Cuckoo3) carry the approach forward.

In triage: mostly historical; reports you find online may come from it.

Watch for: an unmaintained sandbox misses modern evasion; prefer CAPEv2.

Open source (unmaintained) · Also: CAPEv2

Deprecated Owner: Open source (unmaintained) Successor: CAPEv2 Checked 2026-10-13 Source

CyberTrap

Deception platform with realistic traps and decoys to misdirect attackers and surface intrusion attempts.

In triage: decoy-interaction alerts with the source host and the lure that was used.

Watch for: as with any decoy, check scanners and admin tools before calling it an intruder.

Vendor: CyberTrap

Hybrid Analysis

Free public malware-analysis service powered by CrowdStrike Falcon Sandbox, with a searchable report archive.

In triage: search by hash for an existing report before submitting anything.

Watch for: submissions and reports are public by default.

Operator: CrowdStrike

Mandiant Security Validation (formerly Verodin)

Breach-and-attack simulation validating security controls against real-world TTPs. Verodin acquired by FireEye, 2019; renamed 2020; Mandiant acquired by Google Cloud, 2022.

In triage: simulated attack actions that should appear in your detections on a known schedule.

Watch for: confirm a hit against the simulation schedule and source host before closing it as authorized.

Vendor: Google Cloud (Mandiant) · Formerly: Verodin

Acquired 2019-05 formerly Verodin Owner: Google Cloud (Mandiant) Checked 2026-10-13 Source

MITRE Caldera

Open-source adversary-emulation platform from MITRE that runs ATT&CK-mapped operations through deployed agents.

In triage: emulation operations that should trigger detections, run by your red or purple team.

Watch for: a Caldera agent (sandcat) on a host nobody scheduled is a finding, not a test.

Maintainer: MITRE (open source)

SafeBreach

Breach-and-attack simulation continuously testing defenses across the kill chain.

In triage: simulator traffic and files appear as real alerts on a known schedule and from known hosts.

Watch for: a suppression for simulator hosts can hide a real intruder on the same host.

Vendor: SafeBreach

Security Datasets (formerly Mordor)

Open Threat Research Forge (OTRF) project that publishes attack and benign telemetry recorded on lab ranges, mapped to ATT&CK. Atomic datasets capture one technique; compound datasets capture a whole campaign, such as the APT29 evaluation.

In triage: rehearse a hunt or a parsing step on telemetry where the technique is known.

Watch for: host logs are JSON lines exported from the range’s pipeline, not .evtx files; after an upload, check that event time is the event’s own timestamp, not the upload time.

Maintainer: Open Threat Research Forge (open source) · Also: Labs

Renamed formerly Mordor Owner: Open Threat Research Forge (OTRF) Checked 2026-10-13 Source

Thinkst Canary

Deception platform deploying low-interaction honeypots and canarytokens that produce high-fidelity alerts on attacker interaction.

In triage: a Canary or token alert names the device or token touched and the source that touched it.

Watch for: backup and indexing jobs can open canarytoken documents; check the process.

Vendor: Thinkst Applied Research

YARA

Open-source pattern-matching engine for identifying and classifying malware: rules describe strings, byte sequences, and conditions that a file or memory region must satisfy. The original C engine is in maintenance mode (critical fixes only); new development happens in YARA-X, a Rust rewrite that runs about 99% of existing rules unchanged but has different APIs and does not yet scan live process memory. The rule language remains the lingua franca.

In triage: scan a file, a directory or a memory image for a family’s known patterns.

Watch for: a rule matches patterns, not intent; broad string rules hit legitimate software.

Maintainer: VirusTotal (open source)

Zscaler Deception (formerly Smokescreen)

Deception with decoys and lures mimicking real IT; alerts on engagement and provides attacker-TTP insight. Smokescreen acquired by Zscaler, 2021.

In triage: decoy engagement alerts, often tied to Zscaler access policy so the user can be cut off.

Watch for: automatic cut-off changes what you can observe; agree the response before deployment.

Vendor: Zscaler · Formerly: Smokescreen

Acquired 2021-06 formerly Smokescreen Owner: Zscaler Checked 2026-10-13 Source

AnyDesk

Commercial remote-desktop application, widely used for IT support and widely abused for hands-on-keyboard access.

In triage: connection logs (ad_svc.trace, connection_trace.txt) record remote IDs and session times.

Watch for: a portable copy run from a user’s Downloads folder, outside your sanctioned RMM, is the classic signal.

Vendor: AnyDesk Software

ConnectWise ScreenConnect

Remote-support and access platform common among managed service providers; also a frequent ransomware entry and persistence tool.

In triage: the client’s relay hostname shows which ScreenConnect instance controls the host.

Watch for: a client pointing at an instance your organization does not own means someone else has access.

Vendor: ConnectWise

ngrok

Tunneling service that exposes a local port to the internet through an ngrok-hosted URL.

In triage: DNS or proxy hits to ngrok domains from a non-developer host.

Watch for: attackers use it to expose RDP or a web shell without opening firewall ports.

Vendor: ngrok

rclone

Open-source command-line tool for syncing files to dozens of cloud storage providers.

In triage: command lines with a remote name and “copy” or “sync”, plus a config file listing destinations.

Watch for: it is a favored exfiltration tool and is often renamed; match on command-line flags, not file name.

Open source

TeamViewer

Commercial remote-access and support software, sanctioned in many organizations and abused in others.

In triage: Connections_incoming.txt and the TeamViewer log record partner IDs and session times.

Watch for: unattended-access setups with reused passwords give an intruder a persistent door.

Vendor: TeamViewer

Acunetix

Automated web vulnerability scanner for SQL injection (SQLi), cross-site scripting (XSS), misconfig, and modern-web/SPA technologies.

In triage: its default user agent and payloads are easy to spot in web logs.

Watch for: attackers run cracked copies; a scan from an unknown IP is not your pentest.

Vendor: Invicti

Burp Suite

Web application security tooling: intercepting proxy, scanning, manual pentest tools, and extensions.

In triage: Burp Collaborator domains in logs signal out-of-band testing.

Watch for: Collaborator callbacks from production with no scheduled test deserve escalation.

Vendor: PortSwigger

Nikto

Open-source web-server scanner for dangerous files, outdated components, and known issues.

In triage: a burst of requests for known-bad paths with a Nikto user agent.

Watch for: the user agent is trivially changed; judge by request pattern.

Open source

Nmap

Network discovery and security auditing with NSE scripting for service detection.

In triage: port-sweep patterns in firewall and NIDS logs, or nmap.exe on an endpoint.

Watch for: internal scanning from a workstation is reconnaissance until a ticket says otherwise.

Open source

w3af

Open-source web application attack and audit framework. No development since 2020 (Python 2 codebase); prefer Burp Suite, ZAP or Wapiti, listed on this page.

In triage: rare; you may still see its user agent from old scripts.

Watch for: do not adopt it for new testing.

Open source (unmaintained)

Deprecated Owner: Open source (unmaintained) Successor: Burp Suite, ZAP or Wapiti Checked 2026-10-13 Source

Wapiti

Open-source command-line web vulnerability scanner; crawls and injects payloads for common flaws.

In triage: crawler-then-payload request patterns against one host.

Watch for: confirm scope and source with whoever owns the test.

Open source

ZAP (formerly OWASP ZAP)

Free, open-source web-app scanner and intercepting proxy, now sponsored as “ZAP by Checkmarx”.

In triage: active-scan request bursts, often from CI pipelines running dynamic application security testing (DAST).

Watch for: pipeline scans against production may be sanctioned; check the build system before escalating.

Sponsor: Checkmarx (open source, Apache-licensed)

Renamed 2024 formerly OWASP ZAP Owner: Checkmarx (open source) Checked 2026-10-13 Source

Acronis Cyber Protect (formerly Cyber Backup)

Backup with integrated anti-malware; blockchain-based notarization and broad workload coverage.

In triage: its anti-malware and backup alerts arrive in the same console.

Watch for: an agent disabled shortly before an incident is a signal, not a coincidence.

Vendor: Acronis · Formerly: Acronis Cyber Backup

Renamed formerly Acronis Cyber Backup Owner: Acronis Checked 2026-10-13 Source

Arcserve UDP

Unified data protection with replication, HA, and ransomware-resistant immutable storage.

In triage: job history shows the last good recovery point before an incident.

Watch for: backup deletion or retention changes in the console log.

Vendor: Arcserve

Carbonite

Cloud-based backup and DR for SMBs; encrypted transmission, hybrid backup, ransomware features.

In triage: file version history for restore and for dating when encryption began.

Watch for: sync-style backups can faithfully copy encrypted files over good ones.

Vendor: OpenText

Cohesity

Data security and backup platform (DataProtect, NetBackup) with immutable snapshots, anomaly detection on backup change rates, and clean-room recovery.

In triage: a sudden jump in changed data between snapshots can date the start of encryption.

Watch for: backup-admin logons and retention changes are high-value events.

Vendor: Cohesity · Also: NetBackup

Commvault

Unified data management; backup, archive, governance, and SaaS-app protection with AI analytics.

In triage: audit trail of job, policy and admin changes in Command Center.

Watch for: its own deception product (Threatwise) is a separate card.

Vendor: Commvault · Also: Commvault Threatwise

Druva

SaaS-delivered data protection for endpoints (via the installed inSync client), SaaS apps such as Microsoft 365 and Google Workspace, and data center and cloud workloads; backups live in Druva’s cloud rather than on customer-run backup storage.

In triage: endpoint and SaaS backup history, plus restore and admin activity logs.

Watch for: a mass restore or download by one admin can be exfiltration through the backup.

Vendor: Druva

NetBackup (formerly Veritas NetBackup)

Enterprise-grade backup with broad workload coverage and centralized hybrid-cloud management. Cohesity acquired NetBackup with Veritas’ data-protection business in December 2024.

In triage: job and audit logs on the primary server.

Watch for: documentation and hostnames still say Veritas.

Vendor: Cohesity · Formerly: Veritas

Acquired 2024-12 formerly Veritas NetBackup Owner: Cohesity Checked 2026-10-13 Source

Rubrik

Cloud-native data management; instant recovery, immutable backups, and ransomware detection.

In triage: anomaly detection on snapshots flags encryption and mass deletion with the affected files.

Watch for: snapshot anomaly alerts lag the activity by one backup interval.

Vendor: Rubrik

Veeam

Backup and recovery across virtual, physical, and cloud workloads with cloud-mobility options.

In triage: Backup and Replication server logs and job history.

Watch for: Veeam servers are a favored ransomware target for stored credentials; check for unexpected logons.

Vendor: Veeam Software

Ansible

Open-source automation for config management, deployment, and orchestration via YAML playbooks.

In triage: playbook runs explain bursts of SSH or WinRM activity from a control node.

Watch for: a compromised control node can push to every managed host.

Vendor: Red Hat (open source) · Also: Ansible Automation Platform

Jenkins

Open-source CI/CD automation server; builds, tests, and deploys with a vast plugin ecosystem.

In triage: build logs and job configuration history show what ran and who changed it.

Watch for: stored credentials and script consoles make it a high-value target.

Open source

Node.js

Event-driven JavaScript runtime on V8; backend services, APIs, automation scripts, and tooling.

In triage: node.exe spawning shells from a package install points at an install script.

Watch for: npm lifecycle scripts run with the developer’s privileges.

Open source (OpenJS Foundation)

PowerShell

Microsoft’s shell and scripting language: Windows PowerShell 5.1 on .NET Framework, cross-platform PowerShell 7 on .NET. The most abused interpreter on Windows (ATT&CK T1059.001). Triage tells: -EncodedCommand or -enc (Base64 of UTF-16LE text), -NoProfile, -WindowStyle Hidden, IEX with a download cradle, and an Office or browser parent. Script Block Logging (Event ID 4104) records de-obfuscated script content.

In triage: pull the 4104 script blocks and any AMSI detections for the process, and read the decoded command, not only the flags.

Watch for: powershell.exe -Version 2 bypasses script-block logging where the v2 engine is still installed.

Vendor: Microsoft · Full entry: C.L.E.A.R.

Python

High-level language ubiquitous in security tooling, automation, data analysis, and ML.

In triage: python.exe or a bundled interpreter running from a temp folder is worth a look.

Watch for: PyInstaller-packed malware looks like an ordinary executable.

Open source (Python Software Foundation)

Visual Studio Code

Microsoft’s Electron-based code editor.

In triage: “code tunnel” sessions (dev tunnels) have been abused for C2, and extensions run with the user’s privileges, so unexpected tunnels or newly installed extensions on non-developer hosts warrant a look.

Watch for: a signed code.exe does not clear the extension or tunnel running inside it.

Vendor: Microsoft · Also: Dual-use tools

Ansible Automation Platform (formerly Ansible Tower)

Red Hat’s enterprise Ansible: automation controller (web UI/API, RBAC, scheduling) over playbooks; upstream project is AWX.

In triage: job history shows which template ran against which hosts and who launched it.

Watch for: stored machine credentials make the controller a lateral-movement hub.

Vendor: Red Hat (IBM) · Formerly: Ansible Tower · Also: Ansible

Renamed formerly Ansible Tower Owner: Red Hat (IBM) Checked 2026-10-13 Source

BigFix

Endpoint management platform automating patching, compliance, and security configuration at scale. Developed by BigFix, Inc.; acquired by IBM in 2010 and by HCL in 2019.

In triage: patch and fixlet status per endpoint.

Watch for: console operators can run arbitrary actions fleet-wide; their actions belong in the timeline.

Vendor: HCLSoftware · Formerly: IBM BigFix

Acquired 2019 formerly IBM BigFix Owner: HCLSoftware Checked 2026-10-13 Source

Jamf Pro

Apple device management (macOS, iOS) for configuration profiles, patching, inventory and scripts; Jamf Protect adds macOS endpoint security.

In triage: device inventory, installed profiles and policy logs for a Mac.

Watch for: Jamf policies run scripts as root; an unexpected policy is a fleet-wide execution path.

Vendor: Jamf

Microsoft Configuration Manager (ConfigMgr; formerly SCCM/MECM)

Patching, software distribution, and compliance for Windows ecosystems; now part of the Microsoft Intune family alongside cloud-only endpoint management.

In triage: deployment and client logs explain software that appeared on many hosts at once.

Watch for: ConfigMgr site servers and network access accounts are well-known attack paths.

Vendor: Microsoft · Formerly: SCCM, MECM

Renamed formerly SCCM, MECM Owner: Microsoft Checked 2026-10-13 Source

Microsoft Intune

Microsoft’s cloud endpoint management for Windows, macOS, iOS and Android: compliance policies, app deployment, scripts and Windows Autopatch updates.

In triage: device compliance state, which feeds Entra Conditional Access, and the scripts and apps assigned to a device.

Watch for: an Intune admin can push scripts to every device; admin role changes deserve alerts.

Vendor: Microsoft

Microsoft WSUS

Windows Server role for approving and distributing Microsoft updates on-premises. Deprecated since September 2024: still shipped and security-patched, but no new features. Microsoft recommends Windows Autopatch or Intune for clients and Azure Update Manager for servers. Treat WSUS servers as high-value targets: CVE-2025-59287, a critical WSUS remote-code-execution flaw, was added to CISA KEV on 24 October 2025 after in-the-wild exploitation.

In triage: update approval and client reporting status.

Watch for: an internet-exposed WSUS server (ports 8530/8531) is an incident waiting to be scoped.

Vendor: Microsoft

Deprecated 2024-09 Owner: Microsoft Successor: Windows Autopatch or Intune for clients; Azure Update Manager for servers Checked 2026-10-13 Source

Ninite Pro

Automates installation and updates of popular third-party software across many endpoints.

In triage: explains a burst of third-party installer activity.

Watch for: verify the parent process before trusting an “updater”.

Vendor: Secure By Design

Progress Chef

Infrastructure-as-code platform (Chef, owned by Progress since 2020) enforcing security configurations via recipes and cookbooks.

In triage: converge runs explain configuration changes on managed hosts.

Watch for: a cookbook change is a fleet-wide change; check who committed it.

Vendor: Progress

Acquired 2020 formerly Chef Owner: Progress Checked 2026-10-13 Source

Puppet Enterprise

Config management automating patching and continuous compliance through code-defined policies.

In triage: run reports show configuration drift and what Puppet changed back.

Watch for: drift that keeps returning means something keeps changing it.

Vendor: Perforce

Qualys Patch Management

Cloud-based patching tied to vulnerability management; prioritizes patches by risk exposure.

In triage: when a missing patch was detected and whether a deployment job ran.

Watch for: “deployed” and “installed and rebooted” are different states.

Vendor: Qualys · Also: Qualys

SolarWinds Patch Manager

Centralized patching for Windows and third-party apps; integrates with WSUS and Microsoft Configuration Manager (ConfigMgr).

In triage: third-party patch publishing and deployment status.

Watch for: it inherits WSUS’s deprecation and attack surface.

Vendor: SolarWinds (taken private by Turn/River Capital, 2025)

Symantec Endpoint Management

Patch management, software distribution, and configuration enforcement across enterprise endpoints.

In triage: inventory and patch state for endpoints it manages.

Watch for: do not confuse it with Symantec’s endpoint protection product.

Vendor: Broadcom · Also: Symantec Endpoint Security

Tanium

Real-time endpoint management and security platform: live questions across the fleet, patching, inventory, threat response and remediation.

In triage: ask every endpoint a question (a hash, a process, a file) and get answers in seconds.

Watch for: question results reflect online endpoints only; offline hosts answer later.

Vendor: Tanium

Tripwire

File-integrity monitoring (FIM) and change detection; enforces baselines and supports compliance. Open-source Tripwire and the commercial Tripwire Enterprise (Fortra).

In triage: what changed on a host’s protected files, and when.

Watch for: FIM records the change, not who made it; correlate with logon and process data.

Vendor: Fortra (Enterprise) · Open source edition · Not the ASSURED escalation tripwire

Acquired Owner: Fortra (Tripwire Enterprise); open-source edition Checked 2026-10-13 Source

Cisco Meraki MV / MT

Cloud-managed smart cameras and environmental and door sensors in the Meraki dashboard; camera and door-sensor events can corroborate physical presence. Cisco’s legacy video-surveillance and IPICS products were retired in January 2026.

In triage: motion and door events near a time and place in question.

Watch for: no access control; badge records come from another system.

Vendor: Cisco

Genetec

Security Center unifies video surveillance, access control, and license plate recognition.

In triage: badge events and nearby camera footage in one timeline.

Watch for: clock drift between badge controllers and log sources; normalize time first.

Vendor: Genetec

LenelS2

OnGuard access control, video, and alarm management for enterprise environments. Acquired by Honeywell from Carrier in June 2024.

In triage: badge-in and badge-out records for a cardholder at a time and door.

Watch for: tailgating leaves no badge record; absence of a swipe does not prove absence.

Vendor: Honeywell · Formerly: Carrier

Acquired 2024 formerly Lenel S2 Owner: Honeywell Checked 2026-10-13 Source

Milestone Systems

Open-platform IP video management (XProtect) with broad camera support and analytics integrations.

In triage: exported footage with an evidence-grade export and audit trail.

Watch for: footage retention is often days; request preservation early.

Vendor: Milestone Systems (Canon)

Verkada

Cloud-managed cameras, access control, alarms and visitor management in a single web console.

In triage: door events and the matching camera clip, linked in one console.

Watch for: cloud-managed cameras are also an attack surface; console admin access deserves review.

Vendor: Verkada