Skip to content

Technology // WARDOG Graph

Your estate, held as one connected state.

Most tooling stores events. WARDOG maintains relationships. The graph is what makes it possible to reconstruct an attack rather than describe fragments of it.

security-state graph // live reconstruction

OBSERVE

IDENTITYOAUTH GRANTMAILBOX RULEENDPOINTPOWERSHELLCHILD PROCC2 DOMAINPEER HOSTFILE STORE

telemetry ingested

simulated scenario · not customer data

Entities and relationships

What the graph holds.

Nodes are the things an attacker uses. Edges are how they were used, and when.

  • Identity

    users, service principals, tokens, sessions, consent grants

  • Endpoint

    devices, agents, users signed in, posture, isolation state

  • Process

    lineage, command line, signer, injected modules, network use

  • File

    hashes, paths, provenance, quarantine state

  • SaaS & email

    apps, OAuth grants, mailbox rules, sharing, forwarding

  • Cloud

    accounts, roles, key material, control-plane operations

  • Network

    domains, destinations, beacon characteristics, egress decisions

  • Threat

    techniques, indicators, prior verified behaviour, package provenance

Why it matters

Reconstruction is a graph problem.

A credential event, a consent grant and a spawned process are unrelated rows in a log store. In a graph, they are one path through one principal — with time, direction and dependency intact.

Continuously maintained

State is updated as telemetry arrives, so investigation starts from current context rather than rebuilding history under pressure.

Time-aware

Relationships carry validity windows, so WARDOG can answer what was true at the moment of compromise, not only what is true now.

Blast-radius ready

Because reach is a traversal, the cost and scope of a containment action can be calculated before it is authorised.

In the loop

Graph feeds every other stage.

  • For Brain

    Supplies the context a hypothesis must explain, and the evidence that can refute it.

  • For Gate

    Provides asset scope, tenant boundary and calculated blast radius as inputs to authority.

  • For Response

    Identifies the precise targets: this session, this grant, this process, this host.

  • For Proof

    Holds the before-and-after state that verification is measured against.

Request early access

WARDOG is in early access with a small number of design partners. Tell us about your estate and we will get back to you.

Talk to us