TotalHealThreatFusion

How it works

1. ConnectAdd any source: TotalHeal agents, the collector or a connector.
2. DetectNetwork, identity and cloud rules mapped to MITRE ATT&CK.
3. CorrelateAlerts about the same person or host join one incident.
4. InvestigateAttack story, security graph and hunting in the console.
5. RespondActions run through your response policy and approvals.

Reference architecture

Key capabilities

• Any event sourceTotalHeal endpoints, the log collector, or connectors for Microsoft Entra ID, Okta, Google Workspace, Microsoft 365, the AWS, Azure and Google Cloud audit logs, and alerts from Defender for Endpoint, CrowdStrike, SentinelOne and Sophos Central.
• One incident per attackAlerts about the same person from network logs, sign-ins, mail and endpoints are joined into one incident; tested with a firewall scan and a sign-in brute force against the same user, on an organisation without TotalHeal EDR.
• Network detection rulesThe same firewall and DNS rules as LogIntelligence: scans, denied-connection bursts, threat-intelligence hits, algorithm-like domains and brute force, mapped to MITRE ATT&CK.
• Identity and cloud detectionsImpossible travel, MFA fatigue, password spraying, brute force, privileged role grants, risky OAuth consent and cloud control-plane changes.
• InvestigationAttack story, security graph, threat hunting and behaviour analytics in the console.

Deployment options

System requirements

Technical specifications