Accelerate Investigation and Incident Response
During incident response and investigations, determining the full scope of an attack is critical. Analysts examine Indicators of Compromise (IoCs) to understand intrusions, identify attacker objectives, and assess the impact on systems. They may have hundreds of suspicious files to examine. Deep, automated analysis accelerates remediation.
Between detection and remediation, the attacker exfiltrates, deploys, and establishes persistence
An incident is detected. The alert typically comes from your EDR: suspicious behavior on an endpoint, abnormal execution, an unknown file. Your EDR detects a threat, but doesn’t always precisely qualify it. It tells you “this file is suspicious,” not “this is a LockBit variant that has already exfiltrated data to this C2 server.”
That’s where the investigation begins and where every second counts.
Your SOC and CSIRT teams need to answer critical questions: which systems are compromised? Which files are malicious? Which indicators will allow you to hunt the attacker across the entire IT environment? To answer these, you need to analyze hundreds, sometimes thousands, of suspicious files collected from endpoints, servers, and logs. Manual reverse engineering takes hours and requires scarce expertise. Every hour spent on analysis is an hour that delays restoring your operations.
The ability to rapidly qualify suspicious data often determines how long your business stays down.
Qualify hundreds of files in minutes, not days
When an incident occurs, you need to answer three questions simultaneously:
1. What is malicious? Out of the hundreds of collected files, which ones are truly dangerous? Which are legitimate tools being misused? Which are decoys?
2. How far did the attacker get? Which systems are compromised? Which accounts were used? Is lateral movement underway toward more sensitive areas?
3. How do you block them everywhere, right now? Which indicators (hashes, IPs, domains, certificates) can be used to hunt this specific threat across the entire IT environment? How can they be leveraged for remediation?
Automated analysis and threat contextualization change the equation — from several hours per file down to seconds.
How? GLIMPS Malware for Data Security lets you launch a mass analysis of files across your IT environment and quarantine malicious items. With GLIMPS Malware Expert, you can conduct deep investigations on specific files with a detailed verdict and full threat contextualization.
Verdicts are exportable and can be used as triggers in SOAR playbooks to automate processes. For example, a document flagged as malicious can automatically trigger endpoint isolation or ticket creation.
Your Tier 1 analysts get immediate access to context that previously required Tier 3 expert intervention.
GLIMPS integrates into your existing operations:
- Automatic enrichment of your EDR alerts with actionable verdicts
- Automated file analysis within your SOAR playbooks
- Threat Intelligence feed through multiple integrations (MISP, OpenCTI…)
From alert to incident response: an accelerated workflow
1. Single or bulk submissions (web interface, API, Host Connector)
2. Each file analyzed in seconds
3. Automatic extraction of IOCs and TTPs
4. Export to STIX, MISP, JSON, PDF and YARA rule generation for extended detection
What your teams get back: time, visibility, and control
For the SOC analyst: No more waiting all day for Tier 3 verdicts. Submit files, get a verdict in seconds, and decide immediately: this one is clean, set it aside; this one is malicious, dig deeper; this one is suspicious, escalate to an expert.
For the CSIRT lead: You can finally answer management’s questions. Which files are malicious? Here’s the list. What’s the scope of the rebuild? We’ve identified it. Recovery Time Objective (RTO) drops because you only rebuild what needs rebuilding.
For the CISO: Post-incident documentation is generated automatically. Reports for your national CERT, sector-specific CSIRT, or regulatory authorities are ready and extracted indicators feed internal Threat Intelligence to detect potential resurgence. Using user datasets, your teams can learn from every incident by training GLIMPS to detect future variants of the threats encountered.
« GLIMPS is the tool that allows us to rapidly identify an incident and thwart a cyberattack. I believe GLIMPS should be part of every SOC/CERT operation: I recommend it to all these communities »
Jonathan Méresse, Tier 2 SOC Analyst, APIXIT
Investigate and respond to incidents with GLIMPS Malware
GLIMPS Malware Expert
Central platform for investigation and file analysis
- 25+ analysis engines (static, dynamic, AI)
- Automatic IOC and TTP extraction
- Secure document preview
- Export to STIX, MISP, PDF, JSON
- YARA editor and retrohunting
GLIMPS Malware for EDR
The automated analysis layer your EDR is missing
- Integration with your EDR (HarfangLab, SentinelOne, SOAR via API…)
- Automated, contextualized verdict on every alert
- Advanced analysis
- Remediation playbook triggering on detection
Day-to-day questions
Yes. By analyzing all files within a given perimeter, you establish a trust core: clean files are preserved, malicious ones are quarantined or eliminated. This significantly accelerates reconstruction.
Submit them in bulk via the API or the Host Connector agent. GLIMPS analyzes them in parallel and returns a prioritized breakdown by threat level. Your analysts focus first on confirmed malicious files, then on suspicious ones — without wasting time on clean files. In a crisis, this ability to absorb volume is the difference between a 3-day investigation and a 3-hour one.
Results are designed to be actionable at every level. A Tier 1 analyst can submit files and interpret verdicts presented in a clear, usable format: straightforward verdict (malicious/clean/suspicious), identified malware family, confidence level. A Tier 3 analyst can go deeper with behavioral analysis, artifacts, and the YARA editor.
Extracted IOCs (hashes, C2 domains, IPs, certificates) are exportable in standard formats (STIX, MISP). Deploy them across your SIEM, EDR, firewall, and proxy to detect and block the attacker everywhere in your IT environment, not just on machines already identified.
Results export to STIX and MISP, the standard Threat Intelligence sharing formats. You share structured, documented indicators, not raw investigation notes.
Submit all files from the compromised perimeter. GLIMPS identifies the malicious ones to eliminate and confirms which are clean. You rebuild on a verified trust core, without reintroducing the threat.