We write our own tooling where off-the-shelf products don't do what we need. The main one is Hound, our threat intelligence engine. It's a tool for our own team: you get the results and our analysis, but we don't sell or license the software.
From raw material to evidence
Hound collects material within an agreed scope, finds exposed secrets and sensitive data, and records everything in a structured, evidenced form.
Inputs, within scope
Hound v14.4.0
- Secret and sensitive-data detection
- Mapping to STIX 2.1
- Evidence packages with chain of custody
Outputs
Where Hound shows up in our work
On Red engagements
Before we test anything, Hound shows us what an attacker could find out about you: forgotten hosts, exposed services, credentials and internal names in public code. That reconnaissance shapes the test.
On Blue work
During an investigation, Hound helps us check whether data or credentials have turned up anywhere. In audits, it finds exposure you didn't know about.
Findings you can rely on
Each finding is mapped to STIX 2.1, an open standard for threat intelligence, so other security tools can read it and it can be shared with partners over TAXII.
Hound stores evidence packages with a hash and a chain of custody, so we can show exactly what was collected, when and by whom. That matters if a finding ends up in front of an insurer or a court.
- STIX 2.1
- The open format for describing threat intelligence: indicators, malware, attack patterns and how they relate.
- TAXII
- The protocol for exchanging STIX data between systems.
- Chain of custody
- A record of who collected each item, when, and every time it was moved or opened since.
Monitoring
For Blue retainers we connect to Wazuh or Elastic SIEM. In-house automation helps us sort through alerts faster, but every decision and every response is made by one of our analysts.
Want to know what's exposed about you?
An exposure check with Hound is often a useful first step. Tell us a little about your organisation.