The XDR
your SOC Needs

Hunters XDR elevates security stacks to detect threats at greater depth and scope, transforming petabytes of organizational data into attack findings.
Scroll to learn how.

Detection and Response at an Attacker's Pace

Do Not Touch !!

Flexible Ingestion

Hunters XDR uses its cloud connectors to pipe into existing data sources and security products from all across the network, cloud, endpoint, and even SIEM.
Connect data easily to start generating insights.

Threat Signal Extraction

Hunters extracts threat signals and alerts from petabytes of existing security data using a stream processing analytics technology. It enables near real-time processing and complex analytics. Threat signal extraction is guided by Hunters’ TTP-based attack intelligence which is also mapped into the MITRE ATT&CK framework.

Read about Hunters' Exclusive detections

1000s

Do Not Touch !!

Investigation and Scoring

In order to contextualize and utilize weak/noisy threat signals, Hunters XDR performs autonomous investigations. It automatically extracts features and entities that were involved in a specific suspicious activity, and leverages ML to score those.

100s

Correlation

Hunters XDR loads investigated threat signals into a graph populated with relevant entities and relationships. It then uses unsupervised learning to correlate them across disparate areas of dense suspicious activity (e.g. suspected phishing email followed by malware downloads on gateway and EDR).

10s

Do Not Touch !!

Actionable Attack Stories

Hunters’ Attack Stories include full attack summary and outline, with details such as context, path, target and potential impact. Attack stories are pushed to customers as high confidence findings which can be escalated to SOC leveraging existing workflows (e.g., SIEM, SOAR, Ticketing Systems, etc.)

Use Cases

Create account on Hunters’ open XDR platform

Connect your stack with a few simple clicks

Gain access to Hunters’ Knowledge Graph to:

USE CASE 1

Triage Automation

Use Hunters' scoring and prioritization to reduce detection and triage time.

USE CASE 2

Incident Response

Expedite incident response by uncovering root cause analysis, and gain unprecedented risk awareness and insights into multi-surface incidents.

USE CASE 3

Threat Hunting

Improve sophisticated threat hunting quests by leveraging Hunters' detections of weak threat signals that bypass siloed organizational defenses.

Use Cases

Create account on Hunters’ open XDR platform

Connect your stack with a few simple clicks

Gain access to Hunters’ Knowledge Graph to:

USE CASE 1

Triage Automation

Use Hunters' scoring and prioritization to reduce detection and triage time.

USE CASE 2

Incident Response

Expedite incident response by uncovering root cause analysis, and gain unprecedented risk awareness and insights into multi-surface incidents.

USE CASE 3

Threat Hunting

Improve sophisticated threat hunting quests by leveraging Hunters' detections of weak threat signals that bypass siloed organizational defenses.

Competitive Comparison

SIEM

Single-Vendor /closed XDR

open XDR

Cloud based and scalable

Yes

Ingestion

Data sources support

Limited analysis support to a variety of data sources

Good analysis support for a vendor-limited products group

Deep analysis across 7 best-of-breed product categories, APIs and static tables

Data sources ingestion

Hard; requires extensive implementation

Easy

Easy.
Few clicks via a SaaS

Out-of-the-box detectors and alerts

No. Limited to a set of generic use cases. Requires extensive implementation

No. Limited to vendor stack

Yes.
Out-of-the-box detectors; no implementation or tuning needed

Detection

Detectors updates

No.
Requires daily efforts from engineering and SOC analysts

Yes

Yes.
Continuously updating and adding detectors according to latest attacks and threat analysis

Attack surface coverage

Limited coverage, minimal cloud coverage

Extended coverage,
vendor-limited

Multiple attack surfaces coverage: enterprise network, cloud environments, endpoint, SaaS, and more

Investigation

Automatic investigation

No. Manual

Yes. Limited to vendor-specific products

Yes.
Out-of-the-box enrichments and investigation playbooks

Scoring of threat signals

No.
Manual daily triage of hundreds of alerts and false positives

Yes

Yes.
ML based scoring points to the interesting threat signals

Correlation

Threat signals correlation

No.
Log correlation only. Limited because different logs work in different semantics

Partial

Yes.
Recursively extracting entities and correlating them on a graph to find highly suspicious attack stories

Weak signals coverage

Included with no context

Not necessarily included

Included and contextualized

Alerting

Many alerts and false-positives

Fewer alerts

No singular alerts. Highly correlated findings

Packaging

High fidelity incidents

Not included

Included

Cost

Based on data volumes. Requires hiring

Based on storage. Premium pricing from existing products

Fixed charge. Does not
require hiring

Competitive Comparison

SIEM

Single-Vendor/
Closed XDR

Yes

Open XDR

Yes

SIEM

Limited analysis support to a variety of data sources

Single-Vendor/
Closed XDR

Good analysis support for a vendor-limited products group

Open XDR

Deep analysis across 7 best-of-breed product categories, APIs and static tables

SIEM

Hard; requires extensive implementation

Single-Vendor/
Closed XDR

Easy

Open XDR

Easy. Few clicks via a SaaS

SIEM

No. Limited to a set of generic use-cases. Requires extensive implementation

Single-Vendor/
Closed XDR

No. Limited to vendor stack

Open XDR

Yes.
Out-of-the-box detectors; no implementation or tuning needed

SIEM

No. Requires daily efforts from engineering and SOC analysts

Single-Vendor/
Closed XDR

Yes

Open XDR

Yes. Continuously updating and adding detectors according to latest attacks and threat analysis

SIEM

Limited coverage, minimal cloud coverage

Single-Vendor/
Closed XDR

Extended coverage, vendor-limited

Open XDR

Multiple attack surfaces coverage: enterprise network, cloud environments, endpoint, SaaS, and more

SIEM

No. Manual

Single-Vendor/
Closed XDR

Yes

Open XDR

Yes.
Out-of-the-box enrichments and investigation playbooks

SIEM

No. Manual daily triage of hundreds of alerts and false positives

Single-Vendor/
Closed XDR

Yes

Open XDR

Yes. ML based scoring points to the interesting threat signals

SIEM

No.
Log correlation only. Limited because different logs work in different semantics

Single-Vendor/
Closed XDR

Partial

Open XDR

Yes.
Recursively extracting entities and correlating them on a graph to find highly suspicious attack stories

SIEM

Included with no context

Single-Vendor/
Closed XDR

Not necessarily included

Open XDR

Included and contextualized

SIEM

Many alerts and false-positives

Single-Vendor/
Closed XDR

Fewer alerts

Open XDR

No singular alerts. Highly correlated findings

SIEM

Not included

Single-Vendor/
Closed XDR

Not included

Open XDR

Included

SIEM

Based on data volumes. Requires hiring

Single-Vendor/
Closed XDR

Based on storage. Premium pricing from existing products

Open XDR

Fixed charge. Does not
require hiring

Resources

DOWNLOAD datasheet

WATCH THE DEMO

DOWNLOAD BRIEF

Hunters FAQ

No, Hunters XDR also utilizes SIEM feeds, and works very differently from it:

Hunters is focused on proactive detection; picking up weak, overlooked signals
Hunters is a machine-led solution, while SIEM requires many human resources
SIEM solutions create many alerts and little findings, Hunters is focused on high confidence findings
Hunters connects and ingests raw, big data, proactively looking for attack TTPs
Hunters interconnects sparse organizational data sources and security telemetry
Combining Hunters with your security data lake can lead to better results than SIEM alone

The XDR
your SOC Needs

Detection and Response at an Attacker's Pace

Do Not Touch !!

Flexible Ingestion

Threat Signal Extraction

Do Not Touch !!

Investigation and Scoring

Correlation

Do Not Touch !!

Actionable Attack Stories

Use Cases

USE CASE 1

USE CASE 2

USE CASE 3

Optional managed Threat Hunting and IR services

Use Cases

USE CASE 1

USE CASE 2

USE CASE 3

Optional managed Threat Hunting and IR services

Competitive Comparison

Competitive Comparison

Resources

Hunters FAQ

Want to learn more? Watch a demo

The XDR your SOC Needs

Detection and Response at an Attacker's Pace

Do Not Touch !!

Flexible Ingestion

Threat Signal Extraction

Do Not Touch !!

Investigation and Scoring

Correlation

Do Not Touch !!

Actionable Attack Stories

Use Cases

USE CASE 1

USE CASE 2

USE CASE 3

Optional managed Threat Hunting and IR services

Use Cases

USE CASE 1

USE CASE 2

USE CASE 3

Optional managed Threat Hunting and IR services

Competitive Comparison

Competitive Comparison

Resources

Hunters FAQ

Want to learn more? Watch a demo

The XDR
your SOC Needs