Devo DeepTrace user guide

Introduction

Devo DeepTrace performs autonomous alert investigations and threat hunting using attack-tracing AI, advancing how security teams easily identify and rapidly investigate threats and secure the organization. Devo DeepTrace helps security teams autonomously investigate alerts and suspicious events and perform threat hunting via:

• Fully documented attack chains that speed investigations: Building attack traces, which fully and chronologically document each attack chain.

• An AI engine that augments analysts: Providing analysts with context and points of reference detailing the attacker’s path through an organization’s infrastructure by asking potentially hundreds of thousands of questions. The AI engine emulates how SOC (Security Operations Center) analysts investigate alerts, incidents, and suspicious behaviors.

• Autonomous investigations that accelerate context-based decision-making: Autonomously traverses historical data to document an adversary’s behavior from start to finish of an attack, providing the facts analysts need to take effective action.

• Autonomous threat hunting to up-skill analysts: Helps threat hunters quickly construct and configure new hunts that map to MITRE ATT&CK framework tactics and techniques. Once refined and validated, these can be converted to new cadence-based threat detections.

What is a trace?

Traces are key artifacts that fully and chronologically document suspicious activity detected across an organization's infrastructure. Traces are the results of autonomous investigations which detect suspicious activity.

Trace data consists of a set of observed activities and their corresponding “evidence”—that is, DeepTrace’s analysis of those activities. You can view a trace in DeepTrace as a variety of interactive visualizations, including a summary graph, a MITRE ATT&CK matrix, a process tree, and a detailed timeline.

What permissions do I need to use DeepTrace?

What permissions do you need to use DeepTrace?

To access DeepTrace and use its features in Devo, you need a specific permission, as well as other satellite permissions to access the areas where these features are used:

• Feature enabler: the DeepTrace features permission is required to enable all the options and menus throughout the platform.

• Auto-investigate in DeepTrace: the Finders permissions is required to open a search and the Alert configuration permission is required to define a new alert, which is where auto-investigations are configured.

• Trace status: the Triggered alerts permission is required to access the alerts history area, which is where traces are displayed and monitored.

DeepTrace in the Devo platform

Devo DeepTrace allows EDR (Endpoint Detection and Response) and other data to be brought into DeepTrace. You can ingest data into Devo via your chosen collector and the data is automatically transferred across into DeepTrace cache for processing—data cache ages out after about six weeks.

The combined deployment is configured to enable alerts and EDR data investigations using DeepTrace. Devo customers that have activated it in their domain have an additional tab in their navigation pane named DeepTrace.

Sending events and alerts to DeepTrace

There are two different ways to start sending events and alerts with Devo DeepTrace:

• New alert definition:

You can activate auto-investigation in DeepTrace when creating a new alert definition from the Data search tab. Once the table is open, click the alert icon to create a new alert definition and select Auto-investigate in DeepTrace. 

• Data search:

You can select suspicious events and send them to DeepTrace for investigation by clicking on the Engine tool button → New → Investigate in DeepTrace. You can also drag the DeepTrace icon from the tools to the main bar. 

You can select one or more events from the table to send them to DeepTrace, or right click on the event to send it.

Once the alert definition is created you can see the status of the alert by clicking on the Alerts or DeepTrace tabs in the navigation pane:

• DeepTrace tab: Click DeepTrace in the navigation pane. A new browser window opens showing you the DeepTrace user interface.

• Alerts tab: Click Alerts in the navigation pane. Check the Trace status column to see the status of your alert. You can also click on the DeepTrace icon that appears in the Action column to open DeepTrace.

There are four possible values for the alert auto-investigation status:

DeepTrace user interface

The DeepTrace user interface enables security analysts to view the results of traces and hunts. Users can also configure new hunts, conduct ad-hoc searches, and trigger new investigations.

Navigation

In the Devo DeepTrace user interface, a navigation panel is shown along the left side of the window. The navigation panel is initially displayed in its compact state. Hovering your mouse along the far-left edge of the navigation panel causes it to expand.

The navigation panel contains the following set of links to pages of the DeepTrace user interface:

Link	Icon	Details
Dashboard		Provides a general overview of: Traces Devices Triggers Leads
Traces		Displays the traces that depict suspicious activities or attacks in a searchable table format.
Devices		Shows a list of the devices implicated in the traces with the highest risk scores.
Search		Enables users to conduct ad-hoc searches for processes exhibiting suspicious behavior and hence to trigger investigations as a result.
Hunt		Enables users to browse the results of hunts that map to MITRE ATT&CK framework tactics and techniques. It also enables users to configure new hunts. Once refined and validated, these can be converted to new cadence-based threat detections.
Triggers		Shows the triggers that started autonomous investigations.
Monitor		Enables users to view Performance data, Statistics, Health data, and the list of monitored devices.
Administration		Enables users to manage DeepTrace configuration settings, such as wh itelists and data adapters.
Log out		Logs the current user out.

Traces page

Traces are artifacts that fully chronologically document each attack chain. Traces are generated by the autonomous investigations that detect suspicious activity.  A trace’s data consists of a set of observed events (“activities”) and their corresponding “evidence”—that is, DeepTrace’s analysis of those activities.

Traces table

The Traces page loads the list of traces from the DeepTrace server and displays the list in a table format. 

The table displays the following information for each trace:

• ID: Identifier of the trace. Click to open the Trace page for this trace in order to view the trace data in detail. To open the Trace page in a separate browser window, click the icon to the right of the ID.

• Risk: Each trace is assigned a composite risk score from 0 (low) to 100 (high). The risk score is derived from the severity of the trace’s evidence data.

• Start Date: The date and time of the first event in the trace.

• End Date: The date and time of the last event in the trace.

• Title: Click here to open the Trace page for this trace in order to view the trace data in detail.

• Devices: The list of devices involved in the trace’s activity. Monitored devices can be listed by hostname; external devices can be listed by IP address. Click on the hyperlinked hostname of a monitored device to open the Device page and explore that device’s detailed data. 

• Tactics: The list of MITRE Tactics detected in the trace’s activity.

• Evidence: The total count of evidence data generated for this trace.

• Status: A trace can be marked as either “open” (needs attention), “closed” (has been resolved), or “ignored” (false positive, duplicate, or no action needed). Click here to change the status of a trace.

Filtering the traces table

At the top of the Traces page are three filters for determining which traces are loaded:

• Date: Select the time range of the traces you wish to see. The table only loads traces which contain some activity that occurred within the selected time range.

• Risk: Select the risk score range of the traces you wish to see. Each trace is assigned a composite risk score derived from the severity of the trace’s evidence data.  The table only loads traces whose risk score falls within the selected risk score range.

• Status: Select the status(es) of the traces you wish to see. A trace can be marked as either “open” (needs attention), “closed” (has been resolved), or “ignored” (false positive, duplicate, or no action needed). The table only loads traces whose status matches one of the selected statuses.

The Traces page searches for traces which match the filter criteria (above) and loads the results into the table. 

Refining the traces display

Above the table there are additional controls for refining the results and their display:

• Metadata filters:

Each trace has metadata associated with it (device, domain, process, username, tactic, technique, etc.). Use the metadata dropdowns to show/hide traces based on their metadata. 

• Grouping:

DeepTrace analyzes traces to detect similarities. The Traces page enables the user to display similar traces together as groups. This can be a useful way to arrange traces and detect repeating patterns of activity across your infrastructure.

• Sorting:

The traces table can be sorted by clicking on the following column titles: ID, Risk, Start Date, End Date and Title.

Changing the status of traces

To change the status of a trace, click on the dropdown in the Status column for that trace in the table.

To change the status of multiple traces simultaneously, first click the checkboxes beside each of those traces in the table. Then click on the dropdown above the table labeled “# selected”, where “#” is the number of traces you have checked.

Trace page

When clicking on a trace ID or title, the Trace page opens to show you the details of that trace.  A trace is the result of an autonomous investigation that detected suspicious activity. The Trace page shows both information about the trace and the data captured by the trace. 

Trace information

The header of the Trace page displays information about the trace itself, such as:

• the trace ID and title

• the start date and end date of the trace (the dates of the first and last events included in the trace)

• the number of devices involved in the trace activities

• the number of triggers which caused the trace to be generated (click here to view a list of the triggers)

• the total count of evidence that was generated by the trace

• the trace status

• the severity of the trace (derived from the severity of all the evidence included in the trace)

Trace data views

Trace data generally consists of a set of observed events (“activities”) and their corresponding “evidence”—that is, DeepTrace’s analysis of those activities. The Trace page can show this data in four views:  

• Summary

• MITRE

• Processes

• Timeline

Each of these views is available as a tab near the top of the Trace page. Click any of these tabs to toggle between the views.

Trace Summary view

Click the Summary tab in the Trace page to view a summary of the trace data. Unlike other trace views, the summary view does not show all of the activity and evidence discovered by the trace. Instead, the summary view emphasizes the devices where the riskiest activities were detected. 

The dataset for this view is derived by first computing cumulative risk scores for each device in the trace based on the corresponding evidence. Then the dataset is filtered to highlight the top devices by risk score. In some cases, lower-risk evidence may also be included in order to preserve connections between devices.

The resulting dataset is visualized in three ways:

• A time series chart which shows the distribution of evidence found over the duration of the trace. This provides you with insight regarding the trend of the evidence.

• A network graph where each graph node is a device and each graph link is a network connection from one device to another. This provides you with insight regarding the topology of the evidence.

• A table of evidence which provides you with descriptive text and other details for each piece of evidence, in chronological order.

Note that all three components use color coding to indicate the severity of the evidence, ranging from blue (low) to red (high). 

Additionally, the summary view supports ad-hoc filtering of evidence:

• To filter the evidence by time, drag your mouse over a slice of the time series chart. This filters the network graph and the evidence table by the selected time range.

• To filter the evidence by device, click on a node in the graph. This filters the table to show the evidence for the selected device.

• To filter the evidence by a network connection, click on a link in the graph.

• To filter evidence by metadata, use the metadata dropdowns above the time series chart.

Each piece of evidence is associated with metadata (device, domain, process, username, tactic, technique, etc.). Use the metadata dropdowns to filter for evidence based on its metadata. Your metadata selections are applied simultaneously to the time series chart, the network graph, and the evidence table.

Trace MITRE view

Click the MITRE tab in the Trace page to view the trace evidence mapped onto the MITRE ATT&CK Matrix for Enterprise. The matrix is an industry-standard categorization of adversary tactics and techniques. Across the top of the matrix are the MITRE tactics. Underneath each tactic are the MITRE techniques that correspond to that tactic. 

The Trace MITRE view is composed of two components:

• A time series chart which shows the distribution of evidence found over the duration of the trace. This provides you with insight regarding the trend of the evidence.

• A tactic & technique matrix where each technique that was detected by the trace is shown color coded by the highest severity of the corresponding evidence, along with a badge displaying the evidence count. Techniques for which no evidence was detected are shown as grayed out.

Click on Show Detected Techniques Only to see only the techniques for which some evidence was detected. This is a useful way to make the matrix more compact and easier to read.

Clicking on an individual technique shows you the corresponding evidence for that technique.

As in the other trace data views, the MITRE view supports ad-hoc filtering of evidence:

• To filter the evidence by time, drag your mouse over a slice of the time series chart. This filters the matrix’s evidence by the selected time range.

• To filter evidence by metadata, use the metadata dropdowns above the time series chart.

Each piece of evidence is associated with metadata (device, domain, process, username, etc.). Use the metadata dropdowns to filter for evidence based on its metadata. Your metadata selections is applied simultaneously to the time series chart and the matrix.

Trace Processes view

Click the Processes tab in the Trace page to view the trace evidence mapped onto the process trees of the monitored devices involved in the trace.

The processes view identifies the cohort commands and relationship graph executed by the offending user or malware out of the thousands of processes that executed within the device and were associated with the trace. This helps to quickly review the attack’s footprint.

The processes view is comprised of three components:

• A time series chart which shows the distribution of evidence found over the duration of the trace. This provides you with insight regarding the trend of the evidence.

• A process graph where each graph node is a process implicated in the trace. Arrows point from parent processes to the child processes which they spawned.  This provides you with insight regarding dependencies.

• A list of evidence which provides you with command lines, descriptive text and other details for each piece of evidence, in chronological order.

Note that all three components use color coding to indicate the severity of the evidence, ranging from blue (low) to red (high). 

The process graph shows the process tree for a single device at a time. Use the dropdown in the top-left corner of the graph to pick the device that you wish to view the process tree for.

The process graph visualizes the process tree as a set of nodes in a hierarchical layout. Processes are shown as rectangular nodes. For additional context, network connections are also included in the graph; the connection targets are shown as round nodes.  Arrows connect parent processes to the child processes they have spawned and/or the network targets they have initiated connections to.

The process tree can include additional nodes in order to provide context or to preserve the integrity of the graph. These processes might not have any corresponding evidence and are shown as grayed out.

Use the buttons in the top-right corner of the process graph to manipulate the graph display:

Button	Icon	Description
Show Vertical Layout		Toggles the graph orientation from horizontal to vertical.
Show Network Connections Only		When turned on, only the processes which were involved in network connections will be highlighted. Other processes are grayed out.
Show Cross Process Activity Only		When turned on, only the processes which were involved in cross process activity (either as the initiator or the target) are highlighted. Other processes will be grayed out.
Show Condensed Layout		This option is a useful way to make the graph more compact and easier to understand at a high level.  When turned on, sibling graph nodes are merged together if either:  (a) they are processes which share the same process filename; or (b) they are network connection targets which share the same hostname or domain; or (c) they are network connection targets which share the first 3 octets of their IPv4 addresses.

As in the other trace views, the processes view supports ad-hoc filtering of evidence:

• To filter the evidence by time, drag your mouse over a slice of the time series chart. This filters the process graph and the evidence list by the selected time range. Note that graph nodes become grayed out once they are filtered out; they are not removed from the graph in order to preserve the graph’s hierarchical integrity. 

• To filter the evidence by a specific process, click on a process node in the process graph. This filters the list to show the evidence for the selected process. If you click on a process which is not associated with any evidence, then no evidence will be shown in the list but you can still view process details, such as the command line, process ID and other properties.

• To filter the evidence by metadata, use the metadata dropdowns above the time series chart.

Each piece of evidence is associated with metadata (device, domain, process, username, tactic, technique, etc.). Use the metadata dropdowns to filter for evidence based on its metadata. Your metadata selections are applied simultaneously to the time series chart, the process graph, and the evidence list. Similar to filtering by time, when graph nodes are filtered out by metadata they become grayed out; they are not removed from the graph in order to preserve the graph’s hierarchical integrity. 

Trace Timeline view

Click the Timeline tab in the Trace page to view all the trace evidence in a single chronological linear display.

Unlike the summary view which only shows some of the trace evidence, the timeline view allows you to browse all the evidence generated by the trace. Unlike the processes view which only shows data for one device at a time, the timeline view shows the evidence across all the monitored devices implicated in the trace in a single view.

The timeline view is comprised of two components:

• A time series chart which shows the distribution of evidence found over the duration of the trace. This provides you with insight regarding the trend of the evidence.

• A list of evidence which provides you with command lines, descriptive text and other details for each piece of evidence, in chronological order. 

The evidence list is shown in a vertical linear layout. The evidence is grouped by process and ordered chronologically. For each process that generated evidence, the display shows the following information:

• The device on which the process executed.

• The process filename.

• The IDs of the process’s parent and the process itself.

• The process command line.

• The date, time and description of the process’s evidence with the highest risk severity.

To conserve space, additional process information is not shown initially but can be revealed by expanding the process’s display. Clicking the arrow to the left of the process filename to expand that process’s display and reveal:

• The local username used to execute the process.

• The full path of the process file.

• Hashes (MD5, SHA-1, SHA-256) of the process executable.

• Any additional evidence generated for that process by this trace, in chronological order.

You can click individual arrows to expand/collapse processes one at a time, or click the Expand All button to expand/collapse all the processes simultaneously.

To the right of each process’s command line is an ellipsis button. Click the ellipsis button to find menu options pertaining to the process:

The process menu options include:

• View Event Details: Click here to open a popup that displays raw event details about the process. This popup also contains tabs for searching for activities conducted by the process, such as 

  • file activity

  • registry activity

  • library loads

  • network connections

• View In Device Explorer: Click here to be redirected to the Device page, where you can view the selected process in the context of the process tree for its host.

• Whitelist: Click here to open a popup that allows you to add this process to DeepTrace’s whitelist. You will be given the choice to whitelist either the process name, full path, or command line. Whitelisted items no longer generate evidence in future autonomous investigations.

Additionally, the timeline view supports ad-hoc filtering of evidence:

• To filter the evidence by time, drag your mouse over a slice of the time series chart. This filters the evidence list by the selected time range. 

• To filter the evidence by metadata, use the metadata dropdowns above the time series chart.

Each piece of evidence is associated with metadata (device, domain, process, username, tactic, technique, etc.). Use the metadata dropdowns to filter for evidence based on its metadata. Your metadata selections are applied simultaneously to the time series chart and the evidence list.

The timeline view also supports suppressing evidence. Unlike ad-hoc filtering which simply shows/hides evidence from the current display, suppressing evidence is a persistent action. Once a piece of evidence is suppressed, it is no longer included in subsequent viewings of the trace.

To suppress a specific piece of evidence:

• Click on the ellipsis button beside the evidence’s text in the timeline display. Clicking the ellipsis button opens a menu as shown below.

• Click the Ignore Evidence menu option if you wish for the selected evidence to be marked as “ignored”. Ignored evidence is suppressed from trace views. You are prompted to confirm your selection before continuing.

Alternatively, you might wish to perform some other action in response to the evidence in the trace, such as conducting lookups on the discovered hashes, IPs and domains. Timeline view supports a set of such actions (configurable by admins).

To perform an action in response to a specific piece of evidence:

• Click on the ellipsis button beside the evidence’s text in the timeline display. Clicking the ellipsis button opens a menu (shown above).

• Click the Take Action menu option. This opens a popup with a list of response actions configured by your DeepTrace admin. 

• Choose an action from the Actions list, input whatever parameters are required by the action, then click Take Action to invoke the action and await its results.

Devices page

The Devices page shows a list of devices that are implicated in traces within a selected time range.

Rather than displaying the full list of all devices monitored by DeepTrace, the Devices page highlights the devices implicated in traces with elevated risk scores. The list is generated by first scanning the riskiest traces within a time range of your choosing. A list of implicated devices is extracted from those traces. Each device is then assigned a cumulative risk level based on the severity of the trace evidence for that device. The Devices page displays the device list sorted from highest risk level to lowest.

Clicking on a device in the list redirects you to the Device page for that selected device. On the Device page is detailed information about the device, including the list of traces in which the device is implicated, the list of processes detected on the device, and additional device statistics.

Device page

The Device page shows you the internal details of a selected endpoint monitored by DeepTrace. The Device page shows both information about the device and the activity data observed on the device.

Device information

The header of the Trace page displays information about the device itself, such as:

• The hostname.

• The IP address.

• The OS type.

• The type and version of the endpoint agent that monitors the device activity.

• The dates when activity data was first and last seen for the device.

• The date of the last bootup reported for the device.

Device data views

Device data generally consists of a set of observed events (“activities”) and their corresponding “evidence”—that is, DeepTrace’s analysis of those activities. The Device page can show this data in four views:  

• Traces

• Processes

• Summary

• Raw Events

Each of these views is available as a tab near the top of the Device page. Click any of these tabs to toggle between the views.

Device Traces view

The Device Traces view displays the traces within a given time range which implicate the device. The display uses a format similar to the display of the Traces page. 

As in the Traces page, the Device Traces view shows the list of traces in a table. There are controls above the table for filtering the traces and refining the display, including grouping and sorting options.

Device Processes view

The Device Processes view displays the processes that were found running on the device within a selected time range. 

The processes can be displayed in either of two displays:

• Table: The processes are rendered as rows in a hierarchical table. The table displays details for each process (such as command line and evidence found, if any). Each parent process is rendered with an arrow beside it. Click the arrow to reveal the child processes of that parent process. This display is useful for browsing the process tree selectively, expanding branches of interest while collapsing others.

• Graph: The processes are visualized as a hierarchical graph, similar to the graph in the Trace page > Processes view. This display is useful for understanding the overall process tree at a glance. Click on an individual process in the graph to view its details in the panel below the graph.

To toggle between the Table display and the Graph display, use the two toggle buttons in the middle-right of the page:

Note that both Table and Graph displays use color coding to indicate the severity of the evidence, ranging from blue (low) to red (high). The Table in particular uses separate color coding for the process name and the expander arrow. Whereas the process name is color coded by the evidence for that process, the expander arrow is color coded by the evidence for its descendant processes. Thus the expander arrow’s color coding can help guide you to the nested processes that have interesting evidence.

Above the process data are controls for selecting a time range. Rather than blindly selecting an arbitrary time range, these controls use evidence from prior investigations to guide you towards selecting time ranges with interesting data. To learn more about selecting a time range in this view, see the later section, Device Page > Selecting a Time Range.

Device Summary view

The Device Summary view displays statistics for activity that was observed on the device within a selected time range. 

Above the statistics data are controls for selecting a time range. Rather than blindly selecting an arbitrary time range, these controls use evidence from prior investigations to guide you towards selecting time ranges with interesting data. To learn more about selecting a time range in this view, see the later section, Device Page > Selecting a Time Range.

Device Raw Events view

The Device Raw Events view displays the activity that was observed on the device within a selected time range. This is the granular data that comprises the statistics you see in the Device Summary view. You can choose to browse the following types of events:

• Network connections.

• Registry activity.

• File activity.

• Process activity.

• Library loads.

The results are displayed in a table format. 

• To sort the results, click on the title of the column you wish to sort by.

• To view the raw event record for a result, click the arrow to the left of the result.

Above the results table are controls for selecting a time range. Rather than blindly selecting an arbitrary time range, these controls use evidence from prior investigations to guide you towards selecting time ranges with interesting data. To learn more about selecting a time range in this view, see the next section, Selecting a Time Range.

Selecting a Time Range

Each of the Device data views has controls for selecting a time range. Your time range selection is used to filter the data displayed in the view. 

In the Device Traces view you are browsing a list of traces, and your selected time range filters that list. In the three other Device data views, however, you are browsing lists of processes, which are far more granular than traces. Therefore, in those three other views, you need to be more restrictive with your time range filter.

Why? Simply put, processes can come and go frequently. Some processes may run for weeks while others may run for less than a second. For this reason, process tree data can grow quickly. Browsing just a few minutes of process data can yield a large unwieldy dataset. For this reason, the three Device data views which show processes (namely: Processes view, Summary view & Raw Events view) only load a 10-minute window of process data by default. You still use a calendar to choose time ranges for these three views, but you must then also select a 10-minute window within the chosen time range.

To choose a 10-minute window, these three views display a time series chart. The chart spans the same time range that you select in the calendar. Your 10-minute window is shown as a light blue vertical slice within the chart. 

Click in the chart to move the light blue slice to a different window of time. The selected time window is shown in text below the chart.

If you selected a time range for your chart which is much longer than an hour, your 10-minute time window may appear less like a band and more like a line due to the chart’s time scale. This can make it challenging for you to select a 10-minute window accurately with precision. When you want more precision, use the chart’s zoom controls:

• In the top-right corner of the chart, click the Mode: Zoom button (the button with the zoom icon). This toggles the chart into Zoom mode.

• Once the chart is in Zoom mode, use a drag gesture to select a time interval that you wish to enlarge. After you complete the drag, the chart zooms into that interval.

• Repeat the drag as needed to continue zooming further if desired. Once you have zoomed in sufficiently, your 10-minute time window might look less like a line and more like a band.

• Once you are done zooming, click the Mode: Select button (the button with the hand icon) in the top-right corner of the chart.  This toggles the chart back to Select mode (which is the default). 

• Once you are back in Select mode, you can click on the chart to move your 10-minute window, as before.

• To zoom out back to the original scale of the chart, click the Reset Zoom button in the top-left corner of the chart.

Due to the high volume and high granularity of process data, choosing a 10-minute window of interesting data can be like looking for a needle in a haystack. With that in mind, the time charts in these three Device views use color coding to help guide you towards interesting data:

• The time chart looks for boot records that intersect the time span of the chart. Time intervals for which there is a boot record are shown in the chart as white; time intervals for which no boot record is found are shown as gray. This helps you avoid choosing a 10-minute time window during which the device may have been offline.

• The time chart also looks for evidence that occurred during the time span of the chart. If found, the distribution of evidence is plotted on the chart, using color coding based on the severity of the evidence. This helps you choose 10-minute time windows during which interesting activity is more likely to have occurred.

• You can also filter the evidence displayed on the time chart. Use the controls above the time chart to filter the evidence based on the risk and status of the traces that generated the evidence, as well as the evidence metadata. This allows you to hone your search for interesting activity more precisely. For example, if you are interested in a particular process, then you can filter the time chart’s evidence by that process, so that you have a clearer view of when that process exhibited interesting behavior. Note that the time chart filters have no effect on the process data below the chart; they only apply to the evidence plotted on the chart.

Search page

Search page allows you to perform ad-hoc searches for processes exhibiting specific behaviors. The search results can then be used to trigger autonomous investigations. 

Defining a search query

At the top of the Search page is a form for defining your search. To define a search, you must specify a time range and a query expression. You can optionally specify a host (either a hostname or IP address) to target a specific device; otherwise your search is performed across all monitored devices.

The search’s query expression is provided using a simple search query language. Use this query language to target specific behaviors, including file access, registry access, network communications, and combinations thereof. You can find examples of search queries by clicking the help button which pops up a separate window with examples.

Query operators

Find below the supported operators of the search query language.

Query fields

The tables below list the fields which you can use in your query expressions.

• Process fields: Use these fields to qualify a process based upon its properties.

• Parent process fields: Use these fields to qualify a process based upon the parent process which spawned it.

• Library fields: Use these fields to qualify a process based upon the libraries that it loaded.

• Action fields: Use these fields to qualify a process based upon an action that it took (i.e., a file action or registry action).

• Network fields: Use these fields to qualify a process based upon the network connections that it is associated with.

• DNS fields: Use these fields to qualify a process based upon DNS lookups that it performed.

Streaming data

Once you have submitted your search, the search is queued and then executed in the background on the server. 

The time required to complete the search varies depending on your search’s time range and target host(s). For lengthy searches, you might start to see partial results streaming into the results table while the search is still in progress.

Above the results table are the controls for the auto-refresh feature. Auto-refresh determines how the table handles partial results whenever newer results become available.

• When auto-refresh is turned on, the table automatically updates (i.e., possibly replace) partial results as soon as newer results become available. If you do not want partial results to be automatically updated, turn auto-refresh off.  

• When auto-refresh is turned off, partial results are not updated automatically. Instead, when newer results become available, you are prompted with a message. The table isn’t updated until you click on that message. This allows you to continue browsing partial results without worrying that they might be replaced unexpectedly.

Working with results

The search results are displayed in a table at the bottom of the page. Each record in the table is a process which matches the criteria in your search query.  The table displays the following information for each process:

• Start and end time (if any).

• The hostname, IP and DeepTrace ID of the device.

• The filename and command line of the process.

• The ID of the process’s parent and the ID of the process itself.

To view expanded process information, click the arrow to the left of the record. This displays the process’s full path, hashes, username and raw event JSON.

To sort the results by a particular column, click the column title at the top of the table. 

To refine the results even further, you can filter by keyword or by particular field values. Records that are filtered out are hidden from the results table. To bring those records back, simply clear your selection.

• To filter by keyword, enter the text into the text box above the table. 

• To filter by field values, use the dropdowns above the table.

Use the ellipsis button to the right of each record to take further action on an interesting result. Clicking the ellipsis button opens a menu with the following options:

• View Event Details: Click here to open a popup that displays raw event details about the process. This popup also contains tabs for searching for activities conducted by the process, such as 

  • file activity

  • registry activity

  • library loads

  • network connections

• View In Device Explorer: Click here to be redirected to the Device page, where you can view the selected process in the context of the process tree for its host.

• Investigate this Event: Click here to open a popup that allows you to trigger an autonomous investigation based on this process. You are prompted to choose an initial time window around the process in which to investigate suspicious activity. If suspicious activity is detected, the investigation generates a new trace.

Hunt page

What is a hunt?

In DeepTrace, a hunt is an intelligent search which looks for suspicious behavior. Hunts can be executed (“run”) once or on a recurring schedule. The results of hunts can be used to start a DeepTrace investigation either automatically or manually. The Hunt page allows you to browse the status and results of these hunts, and to configure custom hunts as well.

Hunts table

The Hunt page loads the list of hunts that are configured in your system and displays the list in a table format. 

The table displays the following information for each hunt configuration:

• Title of the hunt, plus a brief description based on the hunt’s search type.

• MITRE Tactic & technique that the hunt is intended to detect.

• Schedule: Whether the hunt is scheduled to recur or only execute once.

• Auto-investigate: Whether the hunt is configured to automatically trigger an autonomous investigation on its results (if any).

• Sharing: Whether the hunt is available to all DeepTrace users, certain selected users, or only the current user.

• Status: Whether the hunt is disabled, enabled or completed.

• Author: The DeepTrace user who created the hunt configuration.

• Created: Date and time.

• Last run: Date and time (if any).

• Results: A trend chart showing the total result counts from the last 12 runs of the hunt (if any).

Refining the hunts display

Above the table there are additional controls for refining the table display:

• Filters: Use the dropdowns to show/hide hunts based on their configuration properties. 

The Results filter dropdown is particularly useful for finding hunts based on whether or not they have found any results (“matches”).

• Grouping: Hunt configurations can be arranged as either a flat list or in groups. The view dropdown allows you to choose how you would like the hunts to be grouped.

• Sorting: The hunts table can be sorted by clicking on the following column titles: Enabled/Disabled, Title, Status, Author, Created and Last Run.

Browsing the hunt results

A hunt can be configured to run once or on a recurring schedule. Click on the title of a hunt configuration in the hunts table to browse the results of its runs. 

Clicking the hunt title opens a panel which allows you to pick from a list of runs (if any) for that hunt configuration. At the top of the panel is the title of the selected hunt configuration. Beneath the title is a dropdown list of runs for that configuration. If the hunt has never been run, the list of runs will be empty. If the run was configured to run on a recurring schedule, you might find several runs in the list.  Select a run to view the results in the table below the list.

Each record in the results table is a process which matches the hunt’s search query. The table displays the following information for each process:

• Start and end time (if any).

• The hostname, IP and DeepTrace ID of the device.

• The filename and command line of the process.

• The ID of the process’ parent and the ID of the process itself.

To view expanded process information, click the arrow to the left of the record. This displays the process’s full path, hashes, username and raw event JSON.

To sort the results by a particular column, click the column title at the top of the table. 

To refine the results even further, you can filter by particular field values. Records that are filtered out are hidden from the results table. To bring those records back, simply clear your selection.

• To filter by field values, use the dropdowns above the table.

Use the ellipsis button to the right of each record to take further action on an interesting result. Clicking the ellipsis button opens a menu with the following options:

• View Event Details: Click here to open a popup that displays raw event details about the process. This popup also contains tabs for searching for activities conducted by the process, such as 

  • file activity

  • registry activity

  • library loads

  • network connections

• View In Device Explorer: Click here to be redirected to the Device page, where you can view the selected process in the context of the process tree for its host.

• Investigate this Event: Click here to open a popup that allows you to trigger an autonomous investigation based on this process. You are prompted to choose an initial time window around the process in which to investigate suspicious activity. If suspicious activity is detected, the investigation generates a new trace.

Managing Hunts

The Hunt page supports managing hunts, including editing, duplicating and deleting hunt configurations.

Each hunt configuration in the hunts table is shown with an ellipsis button beside it (far right). Clicking the ellipsis button opens a menu with the following options:

• View Results: Click here to open a panel with the results of the hunt’s runs, if any. This is the same as clicking on the hunt’s title.

• Enable/Disable Hunt: Click here to toggle the hunt’s status between enabled and disabled.

• Start Hunt: Click here to manually start a run of this hunt now regardless of its schedule.

• Settings/Edit Hunt: Opens a popup for editing the hunt’s configuration. Users who have permission to edit the hunt see Edit Hunt; otherwise, this menu option says Settings and the popup only shows the hunt’s configuration as read-only.

• Duplicate Hunt: Opens a popup for editing the configuration of a new hunt. The popup is automatically pre-populated with the same configuration settings as the selected hunt. Use the popup to make any changes needed, then click Save to save the configuration for this new duplicate hunt.

• Delete Hunt: Deletes the hunt configuration and its run results (if any).

Configuring Hunts

The Hunt page supports the creation of custom hunt configurations and the editing of configurations of your existing hunts.

• To configure a new hunt, click the New Hunt button above the hunts table. This opens the hunt configuration editor.

• To edit the configuration of an existing hunt in the hunts table, click the ellipsis button to the right of the hunt, then click the menu option Edit Hunt. This opens the hunt configuration editor (you only have permission to edit hunts that you own).

The Hunt Configuration Editor allows you to specify the following information regarding your hunt:

• Title of the hunt configuration.

• State: Whether the hunt is enabled or disabled. A disabled hunt doesn’t execute on its schedule until it has been enabled.

• Search Type: DeepTrace supports a number of different types of intelligent hunts. Click on the dropdown to browse the list. Clicking on an option from the list displays a description of that option. If you select an option that requires additional parameters, then you are prompted for those parameters as well. For example, if you select the “Suspicious powershell cmdlets” option, then you are prompted to input the cmdlet.

• Device: You might optionally specify a hostname or IP address to limit your hunt. Otherwise, the hunt covers all monitored devices by default.

• Auto-investigate Hunt Results: If you enable this feature, then the results from the hunt are used to automatically trigger a DeepTrace autonomous investigation. If that investigation finds suspicious evidence, it results in the generation of a new trace. Otherwise, if you do not enable this feature, you can still browse the hunt results from the Hunt page, where you will have the opportunity to manually trigger an investigation if you wish.

• Schedule: Choose whether to run this hunt one time or on a recurring schedule. The results of each run are available for browsing in the Hunt page.

• Sharing: You can share your hunt with other DeepTrace users. When a hunt is shared, only the owner can modify its configuration. However, other users can create their own duplicate copy of the hunt which they can then modify as desired. 

• Tags: Set custom tags on your hunt configurations in order to help you stay organized. By convention, it is customary to specify at a minimum the MITRE Tactic & Technique that the hunt is intended to detect.

• Notes: Notes is a free-form text area where you may specify whatever additional context is helpful pertaining to the hunt.

Triggers page

The Triggers page allows you to browse the triggers that were investigated by DeepTrace. In DeepTrace, investigations can be triggered by:

• Devo alerts: Alerts in Devo can be configured to auto-investigate their results in DeepTrace. This includes imported alerts from EDR sources.

• Devo hunts: Devo users can manually send search results to DeepTrace for further investigation.

• DeepTrace hunts: DeepTrace hunts can be configured to auto-investigate their results. Alternatively, DeepTrace users can manually initiate investigations from the results of a DeepTrace hunt or a DeepTrace ad-hoc search.

Click on the ID or title of the trigger to view its details, including the list of traces and implicated devices (if any) which resulted from the investigation.

Monitor page

The Monitor page allows you to access the following pages which pertain to the health of the system:

• Performance: Shows a pre-configured dashboard of graphs for plotting key hunting and system statistics.

• Statistics: Shows the raw real time statistics associated with various micro services. Typically, useful for troubleshooting various functions which may be asked by the supported team.

• Health: Shows the general health of the system including key system resources.

• Devices: Shows a list of the endpoints currently being monitored.

Administration page

The Administration page allows users with administrator privileges to access various settings pertaining to the configuration and administration of DeepTrace. The page is divided into these sections:

• Download Event Forwarded Installers

• Analysis

• System

The contents of each section are listed below.  Note that some content is only available when DeepTrace is deployed in Standalone mode rather than integrated with a Devo deployment.