Tracknosis reads each Windows volume directly, compares it with earlier scans, and shows every file and registry change, rated for risk, with hash-verified evidence. It works alongside your SIEM, sending its findings to Splunk, with no rip-and-replace.
Your SIEM sees the events that were logged and forwarded. Tracknosis reads the file system and registry themselves, so it sees what actually changed, even where nothing was logged.
Splunk, Datadog and Elastic are excellent at collecting logs and alerts. They can't show what changed on a machine nobody told them to watch. Tracknosis can.
Every file and registry key on each Windows volume, compared scan to scan, producing defensible evidence rather than more alerts.
Identifies what changed before the incident occurred, turning a symptom into a diagnosis and helping stop it happening again.
No signatures needed. Faked timestamps, cleared logs, switched-off auditing and risky new auto-starts show up as change, so new and unknown attacks are visible too.
Report drafts built from the evidence to support NIS2, CIRCIA, DORA and UK GDPR deadlines, so you start from facts, not a blank page.
AI drafts the incident summary from the changes Tracknosis found, with every finding traceable back to hash-verified evidence, for your team to review.
Read-only collection, hash-verified results stamped with machine and operator, and recovered files never written back to the volume under investigation.
Detection tells you something is wrong now. Delta tracking tells you what changed before it went wrong, turning an alert into a root cause you can fix and prove.
The first scan records every file and registry key on the volume. It already flags problems that are there now, such as faked timestamps and risky auto-start entries.
Each rescan is compared with the history, so you can pick any two points and see exactly what was added, edited or deleted between them, and when.
Every change is rated High, Medium or Low using its location, file type, digital signature, download origin and timestamps. Routine noise can be hidden by rules; High-risk changes never are.
Results are hash-verified and stamped with machine, volume, tool version, operator and time, building an audit trail you can stand behind.
Send findings to Splunk, export the report, and generate an AI report draft from the evidence for NIS2, CIRCIA and other reporting rules.
| Question after an incident | Logs & SIEM alone | With Tracknosis |
|---|---|---|
| What changed? | Only what was logged and forwarded | Every file and registry change between scans |
| Did they try to hide? | Cleared logs can go unnoticed | Cleared logs, disabled auditing and faked timestamps flagged |
| Is it still there? | Hard to tell from alerts | New auto-start entries linked to their files, signed or not |
| Can we prove it? | Log exports of varying completeness | Read-only, hash-verified evidence stamped with machine, operator and time |
| What must be reported? | Written from scratch under pressure | AI report draft built from the evidence, for your team to review |
Tracknosis is built to answer one question with evidence: what changed? The same scans and the same agent also give you these, at no extra effort.
Installed software on each machine, read from the registry on disk, with versions and publishers, ready to export.
Machine, operating system and hardware details, with your own asset tag and owner recorded alongside.
New and changed auto-starts, services and other persistence, cleared logs and switched-off auditing, summarised since the last scan. Detection findings, not prevention.
Certificates that are expiring, self-signed or using weak cryptography, and newly trusted root certificates, from the live stores or the scanned registry.
A live view of listening ports with the process behind each one, flagging risky ports and new listeners.
Live CPU, memory and disk gauges, with a trend recorded at each scan.
Tracknosis is a lightweight agent: a Windows application you run on the machine you want to examine. There is nothing to install in the kernel and no logging pipeline to build.
Download the Tracknosis technical whitepaper, or talk to our engineers about running Tracknosis on your Windows estate.
Download the Technical Whitepaper Talk to Engineering