Morphick Analytical Pivoting

Analytical Pivoting is a capability within the Morphick Defense Platform that allows security analysts to investigate threats across a client's network by correlating and cross-referencing indicators such as IP addresses, URLs, files, hosts, and email attachments. Rather than relying solely on traditional event correlation, which analysts note only surfaces a portion of an attack, the platform lets analysts start from a single indicator, such as a malicious communication, and pivot outward. For example, an analyst can identify a malicious communication, pivot to find all hosts involved, pivot on those hosts to uncover a previously unknown backdoor, pivot on the backdoor to find the malicious email that delivered it, and pivot on the email's X-Mailer header to identify related malicious emails. The platform aggregates data across multiple security tools and client networks into a single interface, enabling analysts to search for any communication involving a given IP or URL, or determine whether a specific file has appeared in an email, on a host, or on the network. This is intended to help analysts trace the full scope of an attack rather than only its initial indicators.