INVESTIGATIONS

Follow sensitive data to where it went

One risky call is easy to spot. Data usually leaves in steps: a read, an archive, an upload. On Pro, advanced rules connect those calls and show them as one investigation in the hosted dashboard.

A credential, database file, mail store or source code is read, may be archived, encoded, encrypted or copied, and then reaches a destination that is new to this machine or already known. Omnodex connects the calls into one investigation. The calls and their order are observed; that what was read is what was sent is inferred.

What it follows

Investigations cover four kinds of data.

Credentials and secrets

Credential files and recognized credential values, sent somewhere other than their own service. Reported by kind, never by value.

Database files and dumps

A database file or dump that is read, then sent to another host, as is or archived or encoded.

Mail stores

A local mail store that is read, then sent to another host, as is or archived or encoded.

Source code

Code pushed to a git host this machine has never reached before.

What one investigation shows

  • Each call in the chain, in order, with its role: where the data came from, what was done to it, where it went
  • The destination, and whether this machine had reached it before
  • For a credential, its kind and whether it was sent as authentication or in a request, never its value
  • Why the chain might be routine, so you can rule it out quickly
  • Which interceptor saw each call

Clear about what it knows

The calls and their order are observed. That the data read is what was sent is inferred, because Omnodex sees the calls, not the bytes they moved. Each investigation says which is which.

Investigations explain what already happened. For activity through the MCP proxy they appear as the last call is recorded; for activity from agent hooks, when the session ends or within about 15 minutes. To stop a single risky call before it runs, use guardrails.

One investigation, step by step

Here a credential file is read, archived, then sent to a host this machine had never reached. Each step names the call behind it, and the investigation says why the chain might still be routine.

An investigation of a credential that may have left the machine: a three-step chain of reading an AWS credentials file, archiving it with tar, and a network call to a first-seen host, with the evidence for each step, what might make it routine, and the findings behind it.

Where to find them

At the top of the Risk Events panel for the sessions in view, most severe first, and on the Investigations page, which lists every investigation across your sessions with filters for time range, severity, stream, machine, session, destination and rule. Like the rest of your data, they are decrypted in your browser.

The Investigations list: each investigation with its severity, a summary, the session, the destination and whether it was reached for the first time, and how many steps and findings it has.

Screenshots show generated demo data, not activity from a real user.

Compare plans Read the docs