Use Case: Incident Response
Breach investigation
A credential was used to access production data 3 weeks ago. The analyst opened 11 browser tabs to reconstruct what happened. ManySignal traversed the entity graph and delivered a complete attack timeline in 40 minutes.
Attack timelines live across 11 different systems
Breach investigation is fundamentally a data assembly problem. The authentication event is in Okta. The lateral movement is in the EDR process tree. The data access is in S3 access logs and CloudTrail. The persistence mechanism is in a different cloud account. The exfiltration is in proxy logs. Without a unified view, analysts spend most of their time in tab-switching and timestamp-matching — manual work that introduces errors and takes days instead of hours.
ManySignal's entity graph links every event across every source to shared entity nodes. During a breach investigation, the analyst identifies the initial compromise point and ManySignal assembles the complete timeline: every authentication, access, execution, and network event connected to the compromised entities, in chronological order, across all sources simultaneously.
workflow: breach_investigation
trigger: confirmed_incident OR investigation_opened
phase_1_timeline:
input: initial_ioc (user / host / ip / hash)
graph_traversal:
- direction: forward (post-compromise activity)
- direction: backward (initial access context)
- depth: configurable (default 3 hops)
sources: siem + edr + cloudtrail + idp + proxy + saas
output: unified_timeline (all events, all sources, chronological)
phase_2_blast_radius:
- systems_accessed: from entity graph edges
- data_touched: file / s3 / database access events
- accounts_pivoted_to: identity chain traversal
- persistence_mechanisms: new_accounts, scheduled_tasks, backdoors
- exfiltration_volume: outbound_data_transfer anomalies
phase_3_reporting:
- executive_summary: plain English, 1 page
- technical_timeline: analyst-grade, all IOCs
- breach_notification: affected data types, record counts
- ioc_export: STIX/TAXII for threat intel sharing
- evidence_package: signed, court-admissible exportSample investigation timeline entry
MITRE ATT&CK coverage
Breach investigation FAQ
How does ManySignal reconstruct an attack timeline from fragmented log sources?
ManySignal correlates events across all ingested log sources using a shared entity model: every event involving a user account, host, IP, or file hash is linked to the same entity node. During breach investigation, the investigator selects the initial compromise indicator, and ManySignal traverses the entity graph forward and backward in time — surfacing related events across SIEM, EDR, CloudTrail, and identity providers into a unified chronological timeline.
Can ManySignal help determine the blast radius of a breach?
Yes. Blast radius analysis starts from the compromised entity and maps all subsequent access events: systems accessed, data touched, accounts used, lateral movement paths. The result is a precise list of affected assets, affected data (by sensitivity classification), and affected users — structured for breach notification analysis.
How far back can ManySignal search during a breach investigation?
Lookback window depends on your log retention configuration. ManySignal queries your SIEM's historical data (typically 90 days to 1 year) and your cold storage (S3, GCS) if configured. For breach investigations requiring longer lookback, ManySignal can accelerate queries against archived logs. The entity graph retains relationship data for the full retention window.
Does ManySignal integrate with incident response platforms during breach investigation?
Yes. ManySignal integrates with ServiceNow, PagerDuty, Jira, and TheHive for case management during active breach investigations. Evidence packages, timeline exports, and blast radius reports are automatically synced to the open incident case. Analysts working in the IR platform have a live link to the ManySignal investigation without switching contexts.
Reconstruct a 3-week-old breach in 40 minutes
Entity graph traversal across all log sources — complete timeline, blast radius, and notification report in one workflow.