What is DRONE?

DRONE is XDR Forensics’s automated compromise assessment feature, providing a powerful decision support system to accelerate security investigations. It automatically analyzes collected evidence and live assets using a library of always-up-to-date analyzers maintained by the Cisco threat hunting team.

DRONE can be executed in multiple operation contexts:

• Responder-side (Assets): Analysis takes place via the Responder on the asset as part of an evidence collection or threat hunt.
• Server-side (Console): Previously collected evidence is analyzed or reanalyzed directly on the XDR Forensics database server, without any requirement to reconnect to the original asset. Learn more in Server-side DRONE Analysis.

On Acquisition and Hunt/Triage you select a DRONE Analyzer Profile. Acquisition runs the analyzers, rules, and configuration saved in that profile. Hunt/Triage runs only the rules selected under the profile’s MITRE ATT&CK Scanner. Re-Analyze in the Investigation Hub is separate: it has no profile and no configuration, and every Case analyzer runs in full on the case tables.

By automatically classifying findings as High, Medium, Low, or Matched, DRONE pinpoints anomalies and potential indicators of compromise, dramatically reducing investigation time and effort.

Read more about DRONE, XDR Forensics’s built-in automated compromise assessment technology here: Automated Compromise Assessment with DRONE