Works by collecting various types of event logs including process execution with cryptographic signature (MD5 hash), network activity, dll/driver loading, as well as miscellaneous system events.
Answers fundamental security questions like:
Build powerful analysis queries using graphical user interface. Example queries:
Graphically walk process execution flow for further analysis.
Use analysis queries for generating alerts.
Allows incident response teams to quickly engage with security events and kick off investigation