Capabilities Entity Fabric and Entity Graph
Capability · Entity Fabric
See the machine, the account and the story, not a list of alerts.
Attackers move through hosts, accounts and applications. Entity Fabric puts those entities at the centre: every alert and finding is attached to the entity it concerns, related activity becomes one case, and the Entity Graph shows how it all connects.
Status: Preview Entity cases and the read-only Entity Graph run in observe mode on real alert data; closing alerts by entity on your SIEM is switched on only after review.
Why entities, not alerts
A single compromised server can raise hundreds of alerts in a day, each one a separate ticket in most consoles. Analysts then rebuild the picture by hand: which machine, which account, what it talked to, whether this is new for it. That work is slow and easy to get wrong when several people handle pieces of the same story.
ApexAI starts from the other end. It keeps one record for each entity in your environment, with its names and aliases, its role, its normal behaviour and everything security tools have said about it. Alerts become evidence on that record. The question an analyst asks changes from “what is this alert?” to “what is happening to this machine or account?”.
What Entity Fabric gives you
One identity per entity
A host seen under a short name, a full domain name and an IP address is one entity. Accounts, IP addresses, domains, processes and cloud resources are handled the same way.
One case per entity story
Alerts on the same entity and the same activity are kept in one case. When an analyst settles it, the conclusion applies to all of its alerts, with every change recorded and reversible.
Facts with their source
Each fact on an entity says where it came from: which SIEM, which product, which log. You can always trace a statement back to its evidence.
Security controls as witnesses
When an EDR or firewall reports that it blocked or allowed something, that verdict is recorded on the entity, so notices can say clearly what was stopped and what passed.
Normal behaviour per entity
Each entity is compared with its own daily and weekly routine. A backup job that runs every night looks different from the same command run once at an unusual hour.
Outside and inside, joined
Internet-facing exposure, known vulnerabilities and leaked credentials are linked to the internal entities they concern, so risk is seen in one place.
The Entity Graph as an investigation surface
The Entity Graph shows an entity with the accounts, machines, addresses and applications around it, and the cases and alerts on each. From any node an analyst can open the case, the timeline or the related evidence, and every empty area says why it is empty rather than leaving a blank.
The graph is read-only. Any action started from it, such as approving a response, goes through the same approval screens, permissions and audit as anywhere else in ApexAI.
What this means for your team
- Fewer, fuller cases: one intrusion is one case with one timeline, instead of many tickets that different people close separately.
- Faster answers to “is this normal for this machine?”, because the entity’s own history is already on the page.
- Clear ownership: shared infrastructure such as domain controllers is shown as context, so it does not pull unrelated stories into one case.
- Everything reversible: grouping, closing and marking by entity keep the previous state and can be undone.
Questions
What is an entity in ApexAI?
Anything an attack can involve and a log can name: a host, a user or service account, an IP address, a domain, a process or file, an application, a cloud resource. Each has one record that gathers its aliases, role, behaviour and evidence.
How is this different from alert grouping in a SIEM?
Grouping usually works per rule or per time window. ApexAI groups by the entity and the story, keeps the entity’s history and normal behaviour alongside, and links what security controls did about it.
Can an entity case close alerts on its own?
Not without approval. In the current preview ApexAI records the closure it would make and the reason; people confirm it. Every change keeps the previous state and can be reverted.
Does the Entity Graph change anything in my environment?
No. The graph only reads. Actions go through the approval screens with their own permissions and audit trail.
See ApexAI on your own alerts.
A walkthrough with your team, in observe mode first: ApexAI scores and proposes, nothing acts on its own.