All use cases

Incident response

Incident Triage

Point-in-time history for the hours the incident actually covers, available while it is still open.

Sign Up Book a Demo

Challenge

The record that explains the alert is older than the window

Validin preserves full history across all our data sources. Feeds and tools that only give you recent history make incident response impossible. With Validin’s extended history going back up to 7 years, you can get context going back to an incident window instantaneously.
  • Query any record as it stood at a specific date and time
  • Reconstruct what a host was serving during the incident window
  • Nothing is aged out, so old incidents remain answerable
24 mo ago 18 mo 12 mo 6 mo Today TYPICAL FEED · 30 DAYS VALIDIN · FULL HISTORY THE RECORD THAT EXPLAINS THE ALERT

Our unmatched history allows you to find the record that actually caused the alert to trigger

What this changes

Scope the entire incident, not only the indicator

A confirmed indicator is the starting point. The history establishes the extent of the exposure.

The incident window

See the resolutions, hosting patterns, and responses as they stood during the incident window.

Related infrastructure

Find the other hosts that shared an IP address or response features at the same time.

Reduce time to triage

Quickly determine exposure and scope.

In practice

Scope is already

Identify a domain that's already been taken offline.

  1. 01

    Domain is already offline

    The domain currently resolves to a parking IP with no meaningful history attached to it.

  2. 02

    Look back at the incident window

    At the time of the beacon it resolved to a server in a different region and served content.

  3. 03

    The server hosts multiple domains

    It was serving other domains during the same time window.

  4. 04

    Find those domains in your logs

    A host that had not yet been flagged. The scope is established during the incident window rather than days after it.

See the DNS timeline

We retain the full history for everything we collect, with no age-out

Explore the platform

Platform features behind this use case

Feature Core Search The primary entry point for infrastructure data across the platform. Feature Active Scanning Analyze a website in real time from one or more geographic locations. Feature Bulk Enrichment Check multiple indicators simultaneously, from a list or a whole report.

Explore other use cases

Enrichment Security Stack Enrichment Deliver context into the SIEM and SOAR so an analyst can judge an alert on the spot. Brand protection Brand Monitoring and Phishing Detection Identify lookalike domains and phishing templates while they are still being staged. Intelligence feeds Customized Threat Intelligence Build feeds shaped around the threats your organization and your customers actually face. Attribution Campaign Attribution Connect scattered domains, addresses, and hashes to one campaign, using overlaps across many independent data sources. Actor research Threat Actor Profiles Maintain a continuous picture of an adversary, drawn from many overlapping open source threat reports.

Get in touch

Contact us

Validin is the first tab I open every morning.
Senior Analyst, Financial Services IT Company