Investigate the Event Flow

Cytomic Orion provides two very flexible yet powerful modules to selectively retrieve information stored in the Cytomic data lake: Advanced SQL Queries and Wizard-guided Queries. Both modules give analysts the possibility to create their own queries or use the queries designed by Cytomic to retrieve the information obtained from the monitoring of each process run on clients’ computers. This information is used in indicator triage and to perform thorough investigations.

Cytomic Orion organizes all the information it collects by type into tables and keeps it available to analysts on the platform for one year.

The retention period for the telemetry stored in the data lake is one year.