Your EDR. Every alert worked.
Irate investigates the detections your EDR already raises and correlates them with the identity, email, network and SaaS evidence an endpoint agent can’t see. CrowdStrike Falcon, Microsoft Defender, SentinelOne and Palo Alto Cortex XDR are all connected.
One vendor’s agent sees one vendor’s data.
Real investigations cross tools. Irate keeps the method, the verdict contract and the evidence trail the same whichever EDR raised the alert, and has caught threats one source under-graded by correlating it with another.
Same verdict, whichever EDR.
Every endpoint detection ends in the same explicit verdict and confidence, backed by the same read-only trail. Adding or changing an EDR doesn’t change how your team reviews the work.
- Benign, false positive, true positive, suspicious or inconclusive
- Evidence cited per finding
- Response actions proposed, then approved by you
- Tool callEmail security: get click forensics
- Tool resultURL detonated · credential form · 7/90 engines
- Tool callEDR: process tree for FIN-WS-01
- Tool callIdentity: sign-ins for jdoe, last 24h
- FindingNew sign-in from unfamiliar ASN, 6 min after click
CrowdStrike Falcon.
Falcon endpoint, NG-SIEM, Identity Protection and Cloud Security detections are worked end to end. Detections, hosts, identity, intel and cases are available to every investigation, and NG-SIEM brings in the third-party sources you already forward.
- Falcon endpoint and NG-SIEM
- Identity Protection
- Falcon Cloud Security (AWS, Azure, GCP)
SentinelOne and Palo Alto Cortex XDR.
SentinelOne Singularity and Cortex XDR detections are worked end to end on the same read-only tool layer and approval gates as Falcon. If you run another EDR, tell us.
- Read-only investigation access by default
- Containment proposed with evidence, never automatic
- Same verdict contract and evidence trail
Hunt in the language you use.
The Irate library carries ready-to-run CrowdStrike NG-SIEM queries mapped to ATT&CK, with one click to open them in your console. Query packs for each new EDR follow its connector.
What security leaders ask first.
If yours isn’t here, an engineer will answer it directly.
Ask us insteadWhich EDRs does Irate support today?
CrowdStrike Falcon, Microsoft Defender XDR, SentinelOne Singularity and Palo Alto Cortex XDR. If you run something else, tell us.
Do we need to replace our EDR?
No. Irate investigates the detections your EDR already raises, through its API. Nothing new is installed on your endpoints.
Can Irate isolate a host?
Containment such as host isolation is proposed with the evidence behind it and carried out only with your approval.
Bring us your backlog.
Thirty minutes, no slideware. Watch Irate work last week’s alerts on your own data.