Introducing Mobasi
DFIR agents that investigate incidents across endpoints, cloud, and SaaS, and help your team respond to threats quickly.
Mobasi
Today we're launching Mobasi: DFIR agents that investigate incidents across endpoints, cloud, and SaaS, and help your team respond to threats quickly.
We've seen the impact of machine-speed attacks and AI-driven discovery of exploits in software. The next wave will require a persistent defender:
Advanced Persistent Defender
- Always on
- Runs as a service in your cloud account
- Responds instantly
- Starts forensic work as soon as an alert fires
- Works across your infrastructure
- CrowdStrike, AWS, Okta, M365, and more
- Collects any evidence
- Disk, memory, processes, logs, network, config
- Lightning-fast analysis
- Minutes to collect and analyze evidence
- Fixes issues on its own
- Automatically approved, or flagged to your team
Two products
Investigate is an agentic workspace for DFIR teams. Load Disk imagesE01, Ex01, AFF4, raw, VMDK, VHDX, QCOW, DMG. NTFS, APFS, ext, HFS+, XFS, FAT. LVM and Volume Shadow Copies.MemoryWindows, Linux, and macOS images.Cloud logsCloudTrail, GuardDuty, GitHub, Salesforce, and any JSON or CSV.Endpoint logsWindows event logs, with Sigma rules through Chainsaw.EmailPST, OST, MBOX, EML, MSG, OLM.Device extractionsCellebrite UFDR, Magnet AXIOM cases, iOS and Android file systems.NetworkPCAP and PCAPNG.CollectionsVelociraptor, KAPE, UAC. into one case, run many agents on it at once, and open any finding in the right viewer with one click. It's built for Take on more engagements with the same team. Mobasi works every client’s evidence in parallel, so your responders start from findings, not raw data.Book a demo, Turn examinations around faster. Mobasi parses disk images, phones, and mailboxes, and every finding cites the record your report depends on.Book a demo, and Handle insider, HR, and fraud matters in house. Mobasi puts the laptop, mailbox, and phone in one case and shows what happened, with sources.Book a demo.
Defend is an Advanced Persistent Defender for An always-on DFIR team in your cloud. Mobasi investigates every alert from your EDR and SIEM to forensic depth and takes the actions you allow.Book a demo: agents that run in your cloud account, investigate alerts to forensic depth, run hunts on demand, and contain threats with evidence behind every action.
Built on evidence
Every answer Mobasi gives cites its sources: the email, the log record, the file on disk, the process in memory. Your team can check each one and stand behind it.
Mobasi reads any evidence, including disk images, memory, phone extractions, mailboxes, cloud and SaaS logs, and network captures from Windows, macOS, Linux, iOS, and Android. Open them all in one case.
Built for speed
Attackers move fast, so we built Mobasi from the ground up for speed. That means you can run analysis that used to take too long to do routinely, like memory analysis and deep disk forensics, on every case.
Built for security
Mobasi runs on hardware or cloud accounts you control, and your evidence stays where it already lives. Prompts and results aren't retained or used for training, and every action is logged so your team can check what was done.
Research
We study how AI changes both attacks and the evidence they leave: how agents carry out attacks, how to keep the tools defenders rely on secure, and how AI can make defenders faster.
Through Sentinel, our security team has published 19 CVEs in open-source forensic tools.