Request Demo

WORKFLOW

From alerts to defensible decisions.

EVIDRYN creates a repeatable investigation path while keeping automatic processing, display-only guidance and analyst-required decisions clearly separated.

CONTROLLED WORKFLOW

From exported alert to analyst decision

Each step is transparent about what EVIDRYN derives automatically and where analyst judgment remains required.

  1. 01

    Import Alerts

    Wazuh JSON or NDJSON exports enter through a bounded local import.

    Automatic processing; analyst authorizes the source data.
  2. 02

    Preserve Evidence

    Source records and provenance remain auditable and are not silently rewritten.

    Automatic preservation; no source deletion.
  3. 03

    Extract Indicators

    Observed IPs, domains, URLs, hashes, files, hosts and users are normalized when present.

    Automatic extraction from actual evidence.
  4. 04

    Explain Triage

    Deterministic reasons support the score, priority, recommendation and confidence.

    Decision support; never a final verdict.
  5. 05

    Construct Timeline

    Alert, evidence and derived events are arranged chronologically.

    Automatic derived view.
  6. 06

    Build Relationship Graph

    Real case entities and evidence-backed relationships become navigable nodes and edges.

    Automatic derived view; no invented entities.
  7. 07

    Add MITRE and LOTL Context

    Supported behaviors are mapped to relevant techniques and living-off-the-land observations.

    Evidence-backed context; analyst validation required.
  8. 08

    Recall Related Cases

    Case Memory compares eligible history and explains shared signals.

    Historical context; not proof of maliciousness.
  9. 09

    Provide Guide Pivots

    Display-only Event IDs and starter queries help analysts verify findings in local telemetry.

    Analyst adapts and runs queries externally.
  10. 10

    Record Analyst Verdict

    The analyst records the authoritative verdict and reason.

    Human decision required.
  11. 11

    Produce Structured Report

    Evidence, context, recommendations and analyst authority are assembled for review.

    Automatic generation from stored case data.
  12. 12

    Verify Backup and Restore

    A hashed manifest protects the integrity of local workspace backups.

    Operator-initiated; backups are not encrypted.

EVIDRYN processes

Normalization, evidence-derived views, deterministic context, similarity results, Guide suggestions and report assembly.

The analyst decides

Whether evidence is relevant, what telemetry confirms it, the final verdict, escalation and every response action outside EVIDRYN.