How Prophet works.

After initial access, a modern attack operates through your infrastructure. It uses machines, identities, and services to maintain access, coordinate activity, move through the environment, and collect data. Those actions produce communication and leave evidence on the systems involved.

Finding that presence requires observation where the activity happens. Communication between cloud workloads, containers, virtual machines, and internal services may never cross a perimeter collection point. The observation layer has to reach those environments.

Prophet provides that layer through lightweight Nodes deployed across hosts and network infrastructure. Nodes measure the shape of communication—timing, volume, direction, connection behavior, and protocol metadata. Encryption can conceal the content while leaving the behavior observable.

Understanding what produced that communication requires evidence from the systems involved. Prophet collects host logs, process execution, authentication, commands, and sessions alongside network communication. It connects those records to reconstruct how access was gained, which identities were used, what ran, and where data went.

Nodes perform collection locally and stream compact telemetry to Prophet. Configuration is managed centrally; Prophet operates the storage, modeling, and investigation infrastructure behind them.

Network communication provides the basis for detection. Host evidence provides the context needed to reconstruct what happened. The observation layer preserves both.

A modern attack can operate across many systems and environments. A connection to a server, communication with an internal service, and an upload to a cloud destination can belong to the same operation. Each exchange can look ordinary in isolation. The relationships between them carry the larger picture.

Detecting the presence of an attacker who has breached your network requires understanding communication across the whole environment. Cloud workloads, physical infrastructure, and self-hosted clusters need to remain part of one connected view, even when their activity is observed in different places.

Prophet constructs a coherent representation of communication across those environments. Distributed observations contribute to a common view of the systems communicating, the services they reach, and how their relationships develop through time.

This gives Prophet the context to examine activity beyond the location where it was observed. Communication from one system can be understood alongside the activity around it, preserving the connections through which a distributed attack operates. The infrastructure can span many environments while the communication remains available to model and investigate as one system.

An attacker can communicate through approved services, familiar destinations, and encrypted connections. The infrastructure carrying the activity can remain legitimate while its use serves an adversarial purpose.

Detection therefore requires understanding whether communication belongs to the activity the network produces on its own. Legitimate environments change constantly: applications are deployed, backups run, and users move data. The detector has to understand that variation while recognizing activity imposed by an attacker.

Prophet learns the structure of communication across many network environments and applies that understanding to your network. It models communication in the context of the systems producing it, the services involved, and the activity around it.

This allows command-and-control and data exfiltration to become visible through their communication behavior, including when they use established services or do not match a known attack signature. A trusted destination does not, by itself, establish that the activity belongs.

Detection is grounded in network communication. When breach signal appears, Prophet begins an investigation to establish what produced it and reconstruct what happened.

Responding to an attack requires understanding how it unfolded: how access was gained, which identities were used, what ran, which systems were reached, and where data went. A network finding opens those questions. The investigation has to answer them.

The evidence is distributed across communication, authentication records, process execution, commands, and sessions. Reconstructing the attack requires connecting those records, establishing their sequence, and testing which explanations the evidence supports.

Prophet performs this investigation autonomously using the network and host evidence it has already collected. It follows the activity back toward its access path, across related systems and sessions, and forward through the actions and communication that followed. Competing explanations are tested as the investigation develops.

The result is a finished investigation with a reconstructed provenance chain, a timeline, supporting evidence, and recommended actions. Each conclusion distinguishes what was observed, what was inferred, and what the available evidence could not establish. The reasoning remains inspectable alongside the result.

Some questions belong to the customer. An investigation can establish that an account accessed a system, ran a command, and transferred data; whether that activity was authorized is a fact about the business. Prophet makes that boundary explicit and presents the evidence needed to resolve it.

Understanding a network takes sustained technical work. Communication and system logs describe activity across many machines and services. Making sense of that activity requires following relationships, examining behavior through time, and deciding which evidence matters.

Prophet provides an expert agent that works directly with its representation of your network and the telemetry behind it. You can ask a question or give it an objective: characterize an application’s communication, examine response timing, map dependencies, explain activity on a system, or conduct a threat hunt across the environment.

The agent examines evidence, follows leads, compares behavior, and tests explanations. A finding can open another question or change the direction of the work. Prophet retains the context as that understanding develops, allowing a task to progress from an initial question into a detailed account of how systems operate.

You can work alongside Prophet through the console or CLI. Follow its progress, redirect its attention, provide additional context, and continue the conversation as the task develops. Conversations can move between the terminal and console. Other agents and automated workflows can invoke the CLI and consume the results.

The result can be an explanation, a map of systems and dependencies, a characterization of application behavior, or a threat-hunt finding. Supporting evidence remains inspectable, with observed relationships, inferences, and unresolved questions made explicit. The work produces an understanding of the environment that you can examine, use, and continue to develop.