Put the security data you already collect to work

Analyze file hashes from existing security tools against verified File Risk Indicators, without deploying a new endpoint agent.

Apply verified intelligence to existing security data

Analysis Services let organizations check file hashes already collected by EDR, DLP, SIEM, forensic and other security tools against verified File Risk Indicators. Use File Analysis API for automated workflows or File Analysis OnDemand for investigator-driven checks. Results can be returned directly into existing security and investigation processes.

Service model

What Analysis Services add to your security environment

Challenge
Turn existing security data into additional insight
Security teams already collect large volumes of file data, but existing tools may not identify specialized human insider risk.
Analysis Services allow organizations to apply NetClean intelligence to file hashes already available in their environment.
APPROACH
Analyze without adding another endpoint agent
File hashes can be checked against verified File Risk Indicators through automated API workflows or investigator-driven OnDemand analysis.
This allows organizations to reuse existing collection capabilities rather than introducing another endpoint detection layer.
OUTCOME
Bring match results into existing workflows
Analysis returns a match or no-match result that can be used as additional context in alerting, enrichment, investigation and response processes.
AUDIENCE
Built for security operations and investigations
Analysis Services support SOC teams, incident response, forensics, insider risk functions, MSSPs and other teams that already collect file hashes and want to apply specialized intelligence to that data.

ANALYSIS SERVICES

Flexible analysis for your workflow

Use the same NetClean intelligence through automated or investigator-driven analysis, depending on how and when you need to check file hashes.

File Analysis OnDemand

Investigator-driven analysis when you need it.

Check selected file hashes directly in ProActive without building an integration. Well suited for targeted investigations, incident response, forensics, due diligence and other case-based analysis.

File Analysis API

Automated analysis within existing security workflows.

Embed file hash analysis into security platforms, automation and monitoring processes. The API checks submitted hashes against verified File Risk Indicators and returns match or no-match results into the customer workflow.

How Analysis Services work

Analysis Services let organizations apply NetClean intelligence to file hashes already collected by existing security tools. File Analysis API and File Analysis OnDemand check submitted hashes against verified File Risk Indicators and return results into the customer workflow.

001
Collect Use file hashes from existing EDR, DLP, SIEM, forensic or other security tools.
002
Detect Submitted hashes are checked against verified File Risk Indicators.
003
Respond Match or no-match results return to existing security workflows.

Want to see how Analysis Services fit into your environment?

Let's talk

INTEGRATION-FIRST

Bring File Analysis API into existing security workflows.

Connect File Analysis API to the security platforms and processes you already use to check file hashes and bring results back into existing workflows. Dedicated connectors, such as Splunk, can simplify integration in supported environments.

Frequently answered questions

What security teams ask us most

001

What data can be analyzed with Analysis Services?

002

Do Analysis Services require a new endpoint agent?

003

What is the difference between File Analysis API and OnDemand?

001

What does an analysis result provide?

002

Can Analysis Services integrate with our existing security tools?

003

What data is sent to NetClean for analysis?

Discover

Explore other ways to use ProActive

ProActive provides three service models for applying the same intelligence foundation. Analysis Services use security data already collected in your environment, while Detection and Intelligence Services provide other ways to identify and use Risk Indicators.

Detection Services
Detect human insider risk at the endpoint
Continuously screen supported file activity against verified File Risk Indicators and surface matches as alerts.Learn more
Intelligence Services
Bring Risk Indicators into existing controls
Use continuously updated, machine-readable Web Risk Indicators in DNS, SASE, SSE and web security infrastructure.Learn more