How it works
From signal to proof in eight governed steps.
Threat Foundry preserves source, analyst decisions, generated work, validation evidence, approvals, and handoffs so context does not disappear between tools.
- 01
Understand bounded context
Bring in selected CTI, exposure, alert, architecture, asset, telemetry, or analyst context with tenant and source boundaries attached.
- 02
Qualify the reason to act
Preserve provenance, markings, lifecycle, confidence, ATT&CK scope, environment relevance, currentness, and the analyst decision.
- 03
Choose the governed outcome
Start or resume a guided workflow for investigation, hunting, detection creation, validation, tuning, migration, connection, or reporting.
- 04
Hunt and investigate
Plan the bounded query, verify telemetry and fields, review any provider contact, then interpret returned and missing evidence.
- 05
Engineer for each environment
Carry one reviewed intent into platform candidates with target-specific fields, telemetry, limitations, and version lineage.
- 06
Validate and tune
Run approved positive and negative controls, retain distinct outcomes, and compare tuning proposals against current evidence.
- 07
Review and deliver
Approve the exact artifact and hand off a case, remediation, report, or customer-controlled package without hidden provider mutation.
- 08
Measure and learn
Use dispositions, source yield, drift, noise, validation age, ownership, closures, and evidence-backed reports to improve the next cycle.
Opening or advancing a workflow does not silently run AI, contact a provider, approve work, export a package, or change provider data. A supported provider-facing read action requires current configuration, permission, exact limits, explicit review, and confirmation.
The governed path
Guidance, evidence, and customer control stay connected.
Start with the workflow
Walk through your own signal-to-proof path.
Bring your current intelligence, exposure, telemetry, architecture, detection content, and analyst or service process. We will map the fastest path to a useful outcome.