Protection, scan, update, and license status at a glance
Review the current protection state, recent activity, product and signature status, edition access, and the next investigation workspace from one starting point.
Current product
One investigation surface, from indicator to handoff.
The in-app Help covers every area below. Availability depends on edition, Windows access, target eligibility, provider rights, and the quality of available evidence.
Current product
One investigation surface, from indicator to handoff.
The in-app Help covers every area below. Availability depends on edition, Windows access, target eligibility, provider rights, and the quality of available evidence.
Hashes, files, URLs, domains, and IPs
Review summary, detections, comments, relationships, pivots, raw JSON, and license-aware VirusTotal API Explorer workflows.
Hash, HEX, YARA, memory, and persistence
Combine known-bad hashes, signature rules, YARA, custom scopes, memory paths, persistence review, and analyst-controlled quarantine.
Behavioral triage with careful verdicts
Score suspicious process, command-line, persistence, network, trust, and PE context without treating heuristic evidence as automatic proof.
Live file, process, registry, network, memory, and timeline evidence
Use the background Guard Service, visible engine state, focused monitor tabs, incident timelines, live executable-memory transitions, and analyst-controlled evidence capture.
Threat Intelligence, Threat Briefing, and Vulnerability Alerts
Hunt with query templates, read trusted-source news, prioritize NVD/CISA KEV/FIRST EPSS evidence, save items, and export reader views.
Dark Web Intelligence and organization-owned feeds
Normalize approved licensed-provider claims without direct onion crawling. Provider licensing, quotas, attribution, and retention remain the organization’s responsibility.
Quarantine Vault, restore, delete, and exceptions
Preserve original path, SHA-256, source, timestamps, and status. Keep containment separate from permanent deletion and review exceptions carefully.
Ransomware Shield
Protect selected folders with canary files, exact allowed-writer paths, mass-change thresholds, attributed response, logs, and safe verification steps.
Automated Unpacker — Experimental controlled unpacking and protected evidence
Controlled Launch only · Not a sandbox · Recovered content is never executed automatically · AlertOnly
API Hook Trace — Enterprise Developer Preview, AlertOnly evidence
Per-session consent · Protected evidence · Partial and Recovery Required remain visible · AlertOnly
Security Connectors
Send normalized, authorized threat events and approved containment requests to organization-controlled HTTPS SIEM, XDR, SOAR, firewall, IDS/IPS, or integration gateways.
Startup & Persistence Manager
Inventory Registry Run/RunOnce entries, Startup Folder items, and executable Scheduled Tasks; remove or disable selected persistence with a transaction-backed restore journal.
Process Memory Capture and Payload & Memory Analyzer
Recover bounded executable-memory evidence from one selected process, then correlate static PE/raw-memory findings, strings, bounded HEX, and matching session evidence in a local HTML report.
Guided API Trace and Deep API Trace
Capture selected-process timelines, supported parameters and return values, memory snapshots, behavior chains, diagnostics, verified ZIP evidence, and an offline Final Report.
Final Report to CISO
Validate supported evidence packages from API Trace, Live Protection, and Payload & Memory Analyzer, correlate independent evidence, require analyst approval, and export a redacted offline HTML/PDF executive report with hashes, evidence links, contradictions, and collection gaps. It does not scan, contain, upload evidence, or make an automatic malware verdict.
DLL Behavior Trace
Preflight a native x86/x64 DLL without loading it, then use an explicit matching-bitness controlled host for an approved export, supported exact API evidence, memory capture, diagnostics, and verified HTML/ZIP reporting in an isolated lab.
Administration and Detection Library
Import, validate, clean, and organize rules; build encrypted private hash/signature/YARA packages; and separate normal database work from Enterprise distribution.
Reports & Evidence, Local Update, and App Lock
Separate final evidence from operational diagnostics, use Enterprise-controlled local detection packages, obtain complete installers from the customer Portal, and protect Enterprise UI access.
Offline Windows Memory Forensics
Version 1.2.1 can show this workspace and its Help guide, but public analysis is not generally available. No real Windows build or production memory-image format is currently claimed as supported; this is distinct from the available live Process Memory Capture workflow.