Is your XDR solution truly comprehensive? Find Out Now!

Search
Close this search box.
Get a Demo

How Fidelis Elevate® Achieves Active Threat Detection

  • Sarika Sharma

Modern security teams face a dual challenge: they’re bombarded with alerts while still missing critical signals that indicate real threats. Fidelis Active Threat Detection tackles this problem by correlating weak signals across multiple phases of attacks, transforming them into actionable intelligence. Let’s examine the technical mechanics behind this capability within the Fidelis Elevate® platform.

The Technical Foundation of Active Threat Detection

Fidelis Active Threat Detection™ operates as an integral component of the Fidelis Elevate® XDR framework. Rather than functioning as a standalone solution, it leverages multiple data streams from across the security infrastructure to build comprehensive threat intelligence.

How Fidelis Elevate works

Deep Session Inspection: The Core Detection Engine

At the foundation of Fidelis Elevate®‘s threat detection capabilities is its patented Deep Session Inspection® technology. Unlike conventional traffic monitoring systems that evaluate only headers or basic packet data, this technology:

  • Processes traffic at speeds up to 20 GB through specialized 1U sensors
  • Inspects content across all network ports and protocols
  • Reconstructs and analyzes complete sessions rather than isolated packets
  • Detects threats concealed within nested files and complex data structures
  • Seamlessly integrates with third-party decryption technologies to examine encrypted traffic both in-line and out-of-band
  • Monitors ephemeral and containerized workloads that frequently escape detection

This deep inspection creates the raw signal data that feeds into the threat detection correlation system.

Continuous Terrain Mapping and Risk Assessment

For accurate threat detection, Fidelis Elevate® first establishes comprehensive visibility through:

  • Real-time inventory collection across on-premises and cloud environments
  • Asset classification and risk profiling
  • Network traffic pattern analysis
  • Data flow monitoring
  • Configuration assessment

This environmental awareness creates the contextual backdrop against which potential threat signals are evaluated.

The Signal Correlation Mechanism

The actual mechanics of Active Threat Detection involve several distinct technical processes:

Signal Aggregation from Multiple Sources

Fidelis Elevate® aggregates data from multiple detection vectors:

Proprietary Correlation Algorithms

These signals then undergo analysis using proprietary algorithms that:

  • Identify potentially related events across different security layers
  • Apply temporal correlation to establish potential attack sequences
  • Evaluate indicators against baseline behavioral patterns
  • Filter out noise and false positives using contextual intelligence
  • Identify connections based on threat actor profiles and TTPs

MITRE ATT&CK Framework Mapping

A crucial technical element is the automatic mapping to the MITRE ATT&CK framework, which:

  • Categorizes observed techniques according to established attack patterns
  • Supplements proprietary detection with industry-standard classification
  • Enables defenders to understand the attack stage and potential next steps
  • Provides a common language for threat analysis and response
Don’t Let Weak Signals Become Missed Threats

Act now to stop what others overlook — before the breach happens. Download the Free Datasheet to Discover:

  • Ways to eliminate alert fatigue
  • Insight into the detection-to-remediation process
  • Mapping threat signals
Download Now

The Technical Workflow of Active Threat Detection

In practice, Active Threat Detection follows a defined technical process flow:

Active Threat Detection Workflow
  • Signal Collection: The system continuously gathers indicators from across the security environment, generating a stream of potential threat data.
  • Initial Filtering: Basic noise reduction removes obvious false positives and low-significance events.
  • Correlation Engine Processing: The remaining signals undergo correlation analysis using the proprietary algorithms described above.
  • Confidence Scoring: Each potential threat pattern receives a confidence score based on the strength, number, and relationships between correlated signals.
  • Conclusion Generation: For high-confidence detections, the system generates an "Active Threat" conclusion containing detailed evidence and attack context.
  • Response Integration: These conclusions integrate with automated response workflows and analyst investigation tools.

Technical Integration with the Security Stack

As an open XDR platform, Fidelis Elevate®‘s Active Threat Detection integrates with existing security infrastructure via:

  • REST APIs for bidirectional data exchange
  • Out-of-the-box connectors for common security platforms
  • Custom integration options through the Fidelis API
  • Webhook-based alert forwarding

This integration ensures that Active Threat Detection enhances rather than duplicates existing security investments.

Real-World Technical Implementation

In practical deployment, Active Threat Detection demonstrates several key technical capabilities:

Threat Pattern Recognition

The system recognizes complex threat patterns, including:

  • Multi-stage attack sequences spanning days or weeks
  • Living-off-the-land techniques using legitimate tools
  • Supply chain compromise indicators
  • Command-and-control communications hidden in legitimate traffic

Real-Time Processing Architecture

The underlying architecture enables:

  • Parallel processing of multiple threat signals
  • Near real-time correlation of disparate events
  • Dynamic updating of threat conclusions as new evidence emerges
  • Continuous recalibration of detection algorithms based on new intelligence

Forensic Evidence Collection

For each Active Threat detection, the system automatically preserves:

  • Relevant network traffic captures
  • Process execution logs
  • File access records
  • Authentication events
  • Configuration changes

This evidence collection happens automatically as threats are detected, creating a comprehensive record for investigation.

Technical Benefits of the Approach

The technical design of Active Threat Detection offers several distinct advantages:

Reduced False Positives

By correlating multiple signals before generating alerts, the system dramatically reduces false positives compared to traditional point solutions.

Increased Detection Confidence

The confidence scoring mechanism ensures analysts receive high-quality alerts with sufficient supporting evidence for immediate action.

Enhanced Investigation Efficiency

Detailed contextual information and evidence preservation streamline the investigation process, reducing time-to-remediation.

Continuous Security Improvement

The system’s intelligence grows over time through: 

  • New correlation rules based on emerging threats 
  • Automatic incorporation of threat intelligence 
  • Feedback loops from analyst investigations

Conclusion

Fidelis Active Threat Detection™ represents a sophisticated technical approach to the modern threat detection challenge. By correlating weak signals across multiple security layers, mapping findings to known attack patterns, and providing rich contextual intelligence, it empowers security teams to detect and respond to threats that might otherwise go unnoticed. The integration of this capability within the broader Fidelis Elevate® platform creates a comprehensive security solution that addresses the full attack lifecycle, from initial detection through investigation and response.

Explore how Fidelis Security can help you!
Talk to an Expert

About Author

Picture of Sarika Sharma
Sarika Sharma

Sarika, a cybersecurity enthusiast, contributes insightful articles to Fidelis Security, guiding readers through the complexities of digital security with clarity and passion. Beyond her writing, she actively engages in the cybersecurity community, staying informed about emerging trends and technologies to empower individuals and organizations in safeguarding their digital assets.

Related Readings

One Platform for All Adversaries

See Fidelis in action. Learn how our fast and scalable platforms provide full visibility, deep insights, and rapid response to help security teams across the World protect, detect, respond, and neutralize advanced cyber adversaries.

Get a Demo