One incident per attack, across every tool you already have

Contents

1. 1Executive summary
2. 2The challenge
3. 3Architecture
4. 4How it works
5. 5Capabilities in detail
6. 6Security and data handling
7. 7Where it fits
8. 8Deployment and system requirements
9. 9Technical specifications
10. 10Getting started

1Executive summary

ThreatFusion joins alerts from TotalHeal products, your firewalls and DNS servers (through the collector) and your identity, cloud and endpoint providers (through connectors) into one incident with an attack story. It does not need TotalHeal EDR.

2The challenge

An attack touches a firewall, a sign-in and a laptop, but each tool raises its own alert and nobody sees that they are one story.

The TotalHeal approach. ThreatFusion joins alerts from TotalHeal products, your firewalls and DNS servers (through the collector) and your identity and cloud providers (through connectors) into one incident with an attack story — it does not need TotalHeal EDR.

3Architecture

4How it works

1. ConnectAdd any source: TotalHeal agents, the collector or a connector.
2. DetectNetwork, identity and cloud rules mapped to MITRE ATT&CK.
3. CorrelateAlerts about the same person or host join one incident.
4. InvestigateAttack story, security graph and hunting in the console.
5. RespondActions run through your response policy and approvals.

5Capabilities in detail

• Any event sourceTotalHeal endpoints, the log collector, or connectors for Microsoft Entra ID, Okta, Google Workspace, Microsoft 365, the AWS, Azure and Google Cloud audit logs, and alerts from Defender for Endpoint, CrowdStrike, SentinelOne and Sophos Central.
• One incident per attackAlerts about the same person from network logs, sign-ins, mail and endpoints are joined into one incident; tested with a firewall scan and a sign-in brute force against the same user, on an organisation without TotalHeal EDR.
• Network detection rulesThe same firewall and DNS rules as LogIntelligence: scans, denied-connection bursts, threat-intelligence hits, algorithm-like domains and brute force, mapped to MITRE ATT&CK.
• Identity and cloud detectionsImpossible travel, MFA fatigue, password spraying, brute force, privileged role grants, risky OAuth consent and cloud control-plane changes.
• InvestigationAttack story, security graph, threat hunting and behaviour analytics in the console.

6Security and data handling

• Works without our EDRFirewall, DNS and identity alerts join one incident on their own.
• People approve impactHigh-impact response always waits for approval.
• Audit you can verifyEvery action on a hash-chained audit trail.

7Where it fits

8Deployment and system requirements

9Technical specifications

10Getting started

• At least one event source: TotalHeal endpoints, the collector or a connector

Start a 30 days trial in the TotalHeal console with a Sttiz account. For a quote, an on-premises installation or the procurement dossier (compliance matrix, bill of materials, architecture and hardening, SLA, OEM authorisation letter), write to business@totalhealsecurity.com.