Request a walkthrough
SNOW connects behaviour, relationships and intelligence for live threat hunting, investigation and authorized response. It also helps investigators uncover evidence of earlier compromise. It combines Arc4dia’s proprietary telemetry and other available evidence from deployed collectors and external sources with backend analysis and human-led investigation.
Endpoint-first describes SNOW’s origins, not the boundary of its analysis. Endpoint telemetry—including endpoint-derived network metadata—is available today, alongside existing threat-intelligence and Shodan enrichment. The aim is to connect the available evidence, not to turn every anomaly into a malware verdict.
Available sources, collector capabilities and deployment scope determine the evidence an investigation can use. Endpoint-derived network metadata does not imply separate network-probe or packet-capture coverage. Architectural flexibility does not imply a shipped integration or universal collection and compatibility.
Follow recorded relationships over time: a remote-desktop session, the process it starts, observed AI-tool activity, a subsequent process or container-related action, a network connection, and the process answering on another enrolled host. SNOW brings these relationships together when the evidence supports each link.
The investigation keeps its context across those steps, rather than treating each event as an isolated alert. Process and container-related records do not imply complete visibility inside a container or capture of every model interaction.
Compare new relationships with the network’s observed history. Review which program was identified from live activity, from a process snapshot or not identified at all. A new relationship is a lead to investigate, not proof of an attack.
Naming a process on the other end requires telemetry from that endpoint. For an external or unobserved destination, an address or a service record is context—not a claim that its process is known.
Anonymized October 2026 example. Question marks and snapshot labels preserve what was—and was not—known.
The example connects recorded programs and their network activity. Unidentified programs remain explicit rather than being filled in by inference.
Review indications of shellcode, covert execution and process injection alongside the process’s history, persistence and connections. Where collection and retention allow, memory evidence gives analysts more to examine than a familiar filename or a signed file on disk.
Investigate living-off-the-land activity (LOTL) and the role of vulnerable signed drivers in bring-your-own-vulnerable-driver attacks (BYOVD). The presence of a vulnerable driver calls for review; it does not establish that the driver was exploited.
Investigate a connection with context about the address on the other end. Shodan-sourced service and exposure records, alongside threat-intelligence context, help analysts understand what an endpoint is reaching—or what is reaching it.
Perimeter views bring public exposure information alongside observed connections. Review services, remote-administration ports and potential vulnerabilities, then decide what needs validation or remediation.
Public scan records have an observation date; they are not a live probe. A version-based vulnerability match is not proof of exploitation. Keep that distinction separate from the activity recorded by the endpoint.
Anonymized October 2026 example. Addresses are masked; counts and scan ages belong to this historical sample, not current coverage.
The example lists exposed services and possible vulnerability matches from dated public scans. It does not establish that a vulnerability was exploited.
Open full-size exposure example (opens in a new tab)
SNOW’s AI-agent module goes beyond tool-name inventory. It groups observed process activity into work sessions, maintains lineage for supported long-running tools, and relates roots such as Claude Code and Codex to the shells, scripts and child activity they launch.
Session records provide redacted command context and activity flags for analyst review, including patterns involving credentials or integrated authentication. A risk flag is not by itself proof of credential theft, unauthorized access or leakage.
This is visibility into recorded tool activity, not a guarantee of complete model interactions or verification of the signed-in account’s organization. Coverage depends on the supported-tool catalog and the telemetry collected in your deployment. Any additional prompt or transcript collection is separately scoped and opt-in.
Endpoint-derived AI-tool activity is distinct from a direct LLM tap. Session tracking does not imply that model requests, responses or complete conversations are collected.
Collect follow-up evidence, preserve investigation context and coordinate the next response steps with your security team. Automation supports the workflow; it does not replace the authority to act.
Available collection and response actions depend on the deployment, permissions and agreed scope. Continuous telemetry collection is distinct from human-review coverage and response commitments, which are agreed for each engagement.
Collect host activity on supported, enrolled endpoints
Organize telemetry, relationships and investigation leads
Review evidence, timelines and investigation context
Network probes: dedicated network probes are on the roadmap. Network metadata ingestion and analysis are already available, including endpoint-derived network metadata; they should not be confused with a deployed standalone probe.
Broader OSINT: an open-source intelligence investigation layer is planned to connect investigation findings with wider external-risk context. This OSINT layer is not yet available in SNOW. It is separate from the threat-intelligence and Shodan enrichment already in use.
