Put investigation evidence to work.
Connect your sources, route findings to your security workflow, and give authorized AI clients access to Elastio tools. Carry the same evidence into compliance reviews.
Connect the analysis to your operations.
- Connect sources
Use the relevant access path.
Cloud APIs, storage connections, and backup connectors expose the data or system copy for analysis. The asset catalog lists source and environment details.
- Start analysis
Set a cadence or trigger.
Use scheduled policies or configured event workflows. GuardDuty findings can trigger Hunt through EventBridge; Wiz events can trigger Hunt through a webhook.
- Deliver findings
Route evidence to the owner.
Send findings and recovery status into the relevant SIEM, notification, or ticket workflow. Your response team owns containment, remediation, and recovery decisions.
Cloud and storage connections
Cloud connections cover AWS, Azure, and IBM Cloud. Google Cloud support is planned for late October 2026. Filer connections include NetApp and Qumulo. Confirm source access, identity permissions, and where analysis runs.
Security, notifications, and ticketing
Use the destination’s setup guide to configure routing. ServiceNow and Jira workflows create investigation tickets; Wiz uses a webhook trigger. Treat these as distinct integration methods.
Give your AI client access to the evidence.
Pursuit’s AI investigates system copies. The MCP Server lets your chosen AI client query Elastio findings, work with artifact records, initiate Hunt operations, and review recovery evidence through the tools available to your tenant.
Tool calls use the operator’s authorized permissions and audit controls. Configure downstream response actions within your team’s approval policies.
“Show open findings for our payment systems and the evidence behind each assessment.”
Use MCP for compatible AI clients, and the CLI or REST API for scripted workflows. Open the documentation for client setup and tool schemas.
Carry the evidence into your review.
Use timestamped findings, analysis scope, recovery-point history, and recorded exceptions to support control reviews and audit preparation. Keep each conclusion linked to its source evidence.
Record the scope
Identify the asset, copy, analysis time, applicable checks, and result.
Explain the gaps
Keep unmet commitments, missing evidence, and exclusions visible to reviewers.
Review the mapping
Map evidence to the relevant framework and control with your compliance team. An analysis result alone does not establish compliance.
Use the Resilience Program to review business commitments and board reporting. Elastio’s own security attestations belong in the Trust Center.
Plan the connection
Start with one workflow.
Choose a source, an analysis policy, and the team that will receive the findings. Review access, data handling, and response responsibilities in the evaluation.