Put investigation evidence to work.
Connect your sources, route findings to your security workflow, and give authorized AI clients access to Elastio tools. Carry the same evidence into compliance reviews.
Connect the analysis to your operations.
- Connect sources
Use the relevant access path.
Cloud APIs, storage connections, and backup connectors expose the data or system copy for analysis. The asset catalog lists source and environment details.
- Start analysis
Set a cadence or trigger.
Use scheduled policies or configured event workflows. GuardDuty findings can trigger Hunt through EventBridge; Wiz events can trigger Hunt through a webhook.
- Deliver findings
Route evidence to the owner.
Send findings and recovery status into the relevant SIEM, notification, or ticket workflow. Your response team owns containment, remediation, and recovery decisions.
Cloud and storage connections
Cloud connections cover AWS, Azure, and IBM Cloud. Google Cloud support is planned for late October 2026. Filer connections include NetApp and Qumulo. Confirm source access, identity permissions, and where analysis runs.
Security, notifications, and ticketing
Use the destination’s setup guide to configure routing. ServiceNow and Jira workflows create investigation tickets; Wiz uses a webhook trigger. Treat these as distinct integration methods.
Agree the analysis path before you connect.
- 01
Connect the source.
Select supported assets and copies. Configure source permissions, encryption-key access, and any connector or analysis resources required by the integration.
- 02
Set the cadence.
Choose configured events or intervals. Account for snapshot availability, retrieval requirements, and analysis compute. Snapshot investigation is separate from runtime monitoring.
- 03
Assign the response.
Route findings to the responsible team. Review guided response steps, execute authorized actions, and examine new evidence after remediation.
Data flow, model configuration, and costs
Hunt’s managed deployment shares data with an Elastio service account for analysis; private-cloud Hunt analysis runs in the customer account. These are different processing paths.
For Pursuit, review the selected model endpoint and the handling of source data, extracted artifacts, model inputs, findings, and metadata. Agree processing locations, retention, access, and responsibility for compute and model costs in the deployment design.
Read-only examination of source copies does not eliminate permissions required to create or operate connectors, analysis jobs, or result storage.
Give your AI client access to the evidence.
Pursuit’s AI investigates system copies. The MCP Server lets your chosen AI client query Elastio findings, work with artifact records, initiate Hunt operations, and review recovery evidence through the tools available to your tenant.
Tool calls use the operator’s authorized permissions and audit controls. Configure downstream response actions within your team’s approval policies.
“Show open findings for our payment systems and the evidence behind each assessment.”
Use MCP for compatible AI clients, and the CLI or REST API for scripted workflows. Open the documentation for client setup and tool schemas.
Carry the evidence into your review.
Use timestamped findings, analysis scope, recovery-point history, and recorded exceptions to support control reviews and audit preparation. Keep each conclusion linked to its source evidence.
Record the scope
Identify the asset, copy, analysis time, applicable checks, and result.
Explain the gaps
Keep unmet commitments, missing evidence, and exclusions visible to reviewers.
Review the mapping
Map evidence to the relevant framework and control with your compliance team. An analysis result alone does not establish compliance.
Use the Resilience Program to review business commitments and board reporting. Elastio’s own security attestations belong in the Trust Center.
Plan the connection
Start with one workflow.
Choose a source, an analysis policy, and the team that will receive the findings. Review access, data handling, and response responsibilities in the evaluation.