Time Machine Agent
Автор: iLink Systems, Inc.
Stop threat actors hiding in months of historical data.
Inputs
- A plain-language ask: an IOC to retro-hunt, an entity or incident to investigate, a
compliance question, a detection query to backtest, or a rule to create or tune.
- Read access to your Sentinel data lake (the agent finds the workspace automatically).
Tasks
- Retroactive IOC hunting and long-term behavioral (UEBA) analysis.
- Forensic timeline reconstruction and incident investigation (isolated event vs. campaign).
- Compliance and audit evidence retrieval.
- Detection backtesting, analytics-rule coverage-gap analysis, and rule/automation tuning.
Outputs
- An audit-ready report: executive summary, findings, affected entities, the exact KQL
used, and coverage gaps — plus risk scores and compromise verdicts where relevant.
- Created, updated, or tuned Sentinel analytics and automation rules — only after your
explicit approval.