Learn from analyst decisions.
Tenant-specific relevance and actionability models can elevate additional items for review. Off, shadow and assisted modes retain the deterministic eligibility baseline.
How it works
From signal to residual-risk proof in nine governed steps.
Threat Foundry preserves source, analyst decisions, generated work, validation evidence, risk approvals, and handoffs so context does not disappear between tools.
- 01
Understand bounded context
Bring in selected CTI, exposure, alert, architecture, asset, telemetry, or analyst context with tenant and source boundaries attached.
- 02
Qualify the reason to act
Preserve provenance, markings, lifecycle, confidence, ATT&CK scope, environment relevance, currentness, and the analyst decision.
- 03
Model threats and likely paths
Connect trust boundaries, components, typed flows, threat hypotheses, controls, assumptions, and scoped attack paths to operational context.
- 04
Choose the governed outcome
Start or resume a guided workflow for investigation, hunting, detection creation, risk review, validation, tuning, connection, or reporting.
- 05
Generate, review, then run
Inspect the selected provider, model, customer-authorized evidence, query plan, limits, and action boundary before provider contact or execution.
- 06
Hunt, investigate, and engineer
Interpret returned and missing evidence, then carry reviewed intent into target-specific detection candidates with version lineage.
- 07
Govern risk and remediation
Review advisory risk, select treatment work, assign accountable owners, and retain the evidence behind the decision.
- 08
Validate and decide residual risk
Run approved controls, retain distinct outcomes, validate implementation, and make the next risk decision against customer-approved appetite.
- 09
Measure and learn
Use dispositions, drift, noise, validation age, ownership, closures, residual risk, and evidence-backed reports to improve the next cycle.
Visible operating boundary
Opening or advancing a workflow does not silently run AI, contact a provider, approve risk, execute a query, export a package, or change provider data. Provider-facing work requires current configuration, permission and customer authorization: interactive review or a separately enabled, bounded automation policy. Scheduled automation retains its policy, scope and execution evidence.
The governed path
Guidance, evidence, and customer control stay connected.
Completed hunt workspace
Workflow diagram
Governed Risk Register
- Finding
- Owner + appetite
- Treatment
- Review decision
Validation Campaign
Workflow diagram
D3FEND Dashboard
- Defensive technique
- Evidence
- Coverage gap
- Next action
Intelligence to action
Automation with explicit authority.
Bring relevant intelligence into reviewed detection and hunting work. Keep interactive review and scheduled policy authorization clear.
Inspect each component.
Review the behavioral core and eligible rule components, then retain execution outcomes, correlations and limitations. Rule association alone is not a detection match.
Authorize a bounded workflow.
An explicitly enabled tenant policy can connect CTI, coverage checks, validated Sigma queries and a Triage handoff. Budgets, source currentness and emergency pause govern each run.
What the automation policy authorizes
Comprehensive Auto Triage is disabled until an authorized tenant administrator opts in. It uses one selected read-only connection and a validated Sigma core; an AI-native core requires human review. Optional detection requests remain review work. The workflow does not deploy rules, scan endpoints, change Cases or treat zero results as proof of absence.
Start with the workflow
Walk through your own signal-to-proof path.
Bring your current intelligence, exposure, telemetry, architecture, detection content, and analyst or service process. We will map the fastest path to a useful outcome.