Capabilities Threat hunting and investigation
Capability · Hunting and investigation
Every case investigated, every new threat hunted for.
ApexAI does the first hours of an investigation for you: it gathers the evidence, checks it against your own logs and threat intelligence, and writes a brief that cites its sources. When new indicators or attack techniques appear, it hunts for them across your environment.
Status: Preview Investigation briefs and intelligence-driven hunts run on real data in observe mode; findings are recorded for analysts and do not raise notices on their own yet.
From alert to answer
Most of an analyst’s time on a case goes into collecting context: the machine’s recent activity, the account’s usual logins, what the address is known for, whether anything similar happened before. The decision itself often takes minutes once that context is in front of them.
ApexAI gathers that context automatically for every case and writes it up as an investigation brief. The brief states what happened, which evidence supports each point, what the security controls did, and what is still unknown. Each statement points back to its source, so an analyst can check it in seconds rather than repeat the work.
What you get
Cited investigation briefs
A short, readable brief per case, with the evidence behind every claim, the relevant ATT&CK techniques and a clear recommendation.
Hunting driven by threat intelligence
New indicators, vulnerabilities and leaked credentials are checked against your own environment, and matches become findings on the entities they concern.
Targeted hunts on high-value assets
Recurring hunts focus on the assets attackers go after first, such as internet-facing web applications and identity infrastructure.
Hunts in your own fields
Queries are written for the field names your SIEM actually uses, and checked before they run, so a hunt does not silently return nothing.
Look-alikes kept apart
Each hunt knows the routine activity that resembles an attack, such as maintenance scripts or authorised scanners, and says how it told them apart.
Lessons from real incidents
Settled incidents and incident-response reports are turned into new hunts, so what was learned in one case is checked everywhere.
How an intelligence-driven hunt runs
01
Signal
A new indicator, technique, vulnerability or leak arrives from your threat intelligence sources.
02
Scope
ApexAI works out which of your entities and log sources could show it.
03
Search
Read-only queries run against your logs within set time windows, with every query recorded.
04
Judge
Results are checked against each entity’s normal behaviour and known look-alikes.
05
Report
Findings are attached to the entity and its case, with the query that produced them and the evidence level.
Built to be checked
- Read-only access to your logs; hunting never changes data or configuration.
- The query shown with a finding is the query that ran, so results can be reproduced.
- A failed or empty search is reported as such, never as a clean result.
- Evidence levels are explicit: observed in the logs, suspected, or not confirmed.
- Threat intelligence from outside sources can raise a question but never closes a case by itself.
- Secrets and passwords are never stored or shown; sensitive values are masked in findings.
Questions
What is automated investigation in a SOC?
It is the gathering and write-up of the evidence an analyst would collect by hand: entity history, related alerts, log searches and threat intelligence, summarised into a brief with sources and a recommendation.
How does threat intelligence turn into hunts?
When a new indicator, technique or leak arrives, ApexAI checks which of your systems could show it and searches your logs for it. Matches are attached to the entity concerned so they appear in context, not as a separate list.
Can hunting slow down or change my SIEM?
Hunts use read-only queries in bounded time windows and are scheduled so they do not crowd out your own searches. They never write to your SIEM.
Does an analyst still review the result?
Yes. In the current preview, briefs and hunt findings support the analyst’s decision. Every brief shows its sources so it can be checked quickly.
See ApexAI on your own alerts.
A walkthrough with your team, in observe mode first: ApexAI scores and proposes, nothing acts on its own.