Request a walkthrough
Turn available evidence into connected investigation context
SNOW Cloud is SNOW’s backend analysis layer. It organizes available telemetry, endpoint-derived network metadata and external intelligence for detection, correlation and investigation in SNOWboard.
The sensor supplies host evidence. The backend adds relationships and context. Analysts use the workspace to assess that evidence and decide what needs attention.
Detection rules and statistical analysis organize suspicious or unusual activity into leads. Process and network records help explain which programs were involved and where their activity connected.
Cross-host process relationships require suitable evidence from both enrolled endpoints. A newly observed relationship is a reason to investigate, not an automatic conclusion. Missing telemetry, shared addresses and uncertain program identity must remain visible as limits.
Shodan-sourced service and exposure records, alongside threat intelligence, help put an endpoint’s connections and public-facing services in context.
A public scan has an observation date. A possible vulnerability match needs validation, and a service identified at an external address is not the same as knowing the process running there. The backend’s context supports an analyst’s assessment; it does not replace it.
A broader OSINT investigation layer remains on the roadmap.
The backend AI-agent module groups supported tool processes and their observed child activity into periods of work. Session records help analysts understand which automation was involved and review related command patterns, including credential-related activity flags.
Session command context is redacted for review. The labels come from telemetry and tool-catalog rules, not from a claim to know the model’s intentions. A session flag does not establish that an account is corporate, that access was unauthorized or that data leaked.
Any additional prompt or transcript collection requires a separately agreed opt-in scope. The activity-tracking module does not imply blanket prompt capture or permission for autonomous response.
Bring related findings and host records into an investigation. Make the retained context available to authorized views and exports so the reasoning can be examined, not just the final label.
Collection and response tasks depend on the deployment, permissions and agreed scope. Automation can organize and gather evidence; it does not decide by itself that a response action is appropriate.
A deployment review covers hosting, retained data, access roles, collection scope and integrations with your security workflow. Those choices determine what analysts can review and how long historical context remains available.
Findings reflect the records collected and processed, not an assumption of complete visibility. Data freshness and evidence gaps matter when reconstructing an event or evaluating whether a change was effective.
