XDR Engine
Cross-domain correlation · attack chain fusion · graph analytics
Active attack chains
17
+3
Signals correlated /hr
58.3k
+12%
Fusion confidence
0.91
mean · active chains
Model drift
0.4σ
within tolerance
Correlated attack chains
Weak signals fused into incidents
AC-9142
Ransomware pre-execution
EDRADSMBDNS
Signals
14
Assets
7
Stage
Actions on Objectives
AC-9139
Cloud takeover via OAuth abuse
OktaAzure ADM365
Signals
9
Assets
3
Stage
Command & Control
AC-9137
Insider data staging
DLPEDRBox
Signals
6
Assets
2
Stage
Collection
AC-9128
Persistent access via scheduled task
EDRAD
Signals
5
Assets
1
Stage
Persistence
Detection surfaces
Coverage across the XDR mesh
Endpoint
14,284
signals / hr
12 models1.2s
Identity
9,812
signals / hr
8 models0.8s
Cloud workload
7,241
signals / hr
11 models1.6s
Network
22,110
signals / hr
6 models0.9s
Email / SaaS
4,901
signals / hr
7 models1.1s
Graph explorer
Entity relationships across the active chain AC-9142