Powered by SNOW
Use threat intelligence and observed endpoint context to prioritize activity for investigation. Classification depends on the available evidence and may remain unresolved.
Review indicators alongside process history, connections and collected artifacts. A classification is part of the investigation workflow, not a guarantee that activity is safe or that compromise has occurred.