A cloud-native XDR platform, built and launched in two years

The challenge

XDR brings alerts and events from endpoints, network traffic, email and cloud into one place, so a security team can detect, investigate and respond from a single console. Built as SaaS, the platform had to bring data from many tools into one consistent schema, scale with its customers, and connect to the security stack each of them already ran.

The goals:

• Bring every source into one schema and one store of alerts.
• Give analysts one place to triage, investigate, hunt and respond.
• Make a new integration something a customer adds from the interface.

What we did

• UX and design: mock-ups and new feature proposals in Figma, a component library for the platform, and demo prototypes that behaved like the real application for sales conversations.
• Authentication and authorization on Microsoft Azure: a fully custom sign-in, two-factor authentication, and user and group management through Azure Active Directory.
• Data ingestion: a Cribl pipeline that turned data from many sources into one consistent schema for the platform’s database, with events queued in Azure Service Bus.
• Alert management: one PostgreSQL store for alerts from every integrated tool, an API in Node.js and GraphQL, and a TypeScript and React interface with advanced filtering, sorting and grouping.
• Investigations: alerts grouped for analysis, with work shared openly across a team and comments added in real time, so each task is done once.
• Response: isolating an endpoint from the console, its traffic blocked until suspicious files are removed or the device is cleared.
• Integrations: an in-house model for connecting the tools in a customer’s infrastructure, from endpoint detection to identity and email, each added from the interface.
• Delivery: automated tests in Playwright and a GitHub Actions pipeline taking changes to every environment, with CodiLime running the product’s cloud infrastructure.

How the threat hunting works

Advanced query, built by CodiLime on Kusto Query Language (KQL), lets security experts search the data by the indicators typical of each type of attack, with live charts of network traffic and threats beside the results.

1. Pick a target Analysts query alerts, evidence or events, and see the results as a graph on a timeline, with details in a table.
2. Narrow the hunt Fields on the side filter the results by value, and dragging across the timeline zooms into any period or bar.
3. Act on the results A right-click menu offers the actions that fit each value, and results can be assigned to a new or existing investigation, tagged with MITRE ATT&CK techniques and a reason for future reference.

After two years of close collaboration the platform launched, with CodiLime’s engineering behind its UX, frontend, backend, data pipeline and cloud infrastructure.