Alerts arrive without proof.
Analysts re-investigate each detection by hand because the traffic behind it was never kept.
أثرAthar · the trace left behind
Every intrusion leaves a trace.
Athar Sec builds two products for the defenders who follow it. QSentry stands sentinel over your network. TraceMind reads the evidence on your machines and explains what happened, citing every source.
- TraceMind: QRDI-awarded research
- Founded by a practicing SOC analyst
- Built in Qatar
The problem
Attackers count on noise.
Security teams drown in alerts while the real story sits in evidence nobody has time to read.
Silence passes for safety.
No alert can mean no attack, or no data. Most tools can't tell you which.
AI fills the gaps with guesses.
A language model will describe an attack the logs never recorded, in confident, fluent prose.
The platform
Two products. One trace.
QSentry, our NDR, catches the first sign of an intrusion on the wire. TraceMind, our path to XDR, follows it into the machines it touched and writes down what it finds, with sources.
QSentry
NDR · the quantum sentry
A sentinel with three lines of watch.
QSentry is network detection and response built in layers. It reads live traffic and judges every flow. When the classical model is unsure, a quantum classifier takes a second look before anything is waved through.
- L1SignaturesMore than 48,000 rules catch known attacks the moment they appear.
- L2Machine learningA model trained on flow behavior flags what signatures miss.
- L3Quantum classifierConsulted only when the classical model's confidence drops.
Working prototype · sub-second alerts in lab tests
TraceMind
XDR · the mind that finds the trace
An investigator that cites its sources.
TraceMind reads the artifacts Windows leaves behind, rebuilds the timeline and explains what happened in plain language. Every sentence links back to the file and record it came from. When the evidence isn't there, it says so.
Today it works from endpoint evidence. Next it takes in QSentry's view of the network and grows into a full XDR.
- Reads the evidence
- Event logs, registry hives, Prefetch, MFT, Shimcache, Amcache, USN Journal and SRUM.
- Rebuilds the timeline
- Every artifact merged into one ordered account of the incident.
- Speaks ATT&CK
- Findings arrive mapped to MITRE ATT&CK techniques, with their indicators.
- Answers in plain language
- Ask about the case. Get cited answers and a report you can hand over.
QRDI-awarded research · event-log pipeline running
How it works
From the first packet to the final report.
-
Watch
QSentry flags a suspicious flow and keeps the traffic behind it.
alert + traffic -
Collect
Artifacts are gathered from the machines that flow touched.
host artifacts -
Reason
TraceMind rebuilds the timeline and drafts findings, each tied to its sources.
cited findings -
Decide
An analyst reviews the evidence and approves. Nothing closes on its own.
QSentry and TraceMind run as separate products today. Next on our roadmap: one case file across network and endpoint, as TraceMind grows into XDR.
Show your work
Every finding opens onto its evidence.
This is the standard we hold TraceMind to. Claims link to records, and missing evidence is called out by name.
Timeline · Qatar time
- EVTX 4624
Network logon, type 3, from 10.0.4.17
- EVTX 7045
Service installed: PSEXESVC
- Prefetch
PSEXESVC.EXE runs for the first time
- EVTX 1102
Security log cleared
Findings
Lateral movement over SMB
T1021.002 SupportedEVTX 4624 #18420EVTX 7045 #2291PSEXESVC.EXE-AD70A45F.pf
Logs cleared to hide activity
T1070.001 SupportedEVTX 1102 #18977
Data taken off the machine
TA0010 Not enough evidenceNo outbound traffic records were collected for FIN-WS07. Add the firewall logs to test this.
Analyst
Did they take any data?
TraceMind
I can't tell yet. Outbound traffic for FIN-WS07 wasn't collected, so its absence proves nothing. Add the firewall logs for 02:00 to 03:00 and I'll check again.
About us
Built by defenders, in Qatar.
Athar Sec brings frontline SOC experience together with QRDI-awarded research in AI forensics. We build for the analyst who has to stand behind every case they close.
- Evidence first
- If a claim can't point to a record, it doesn't ship.
- Defense only
- We build for defenders, and our tools run only where the owner has authorized them.
- People decide
- Our tools recommend. Analysts approve.
- Rooted in Qatar
- Built here, for the security teams of Qatar and the Gulf.
أثر
atharArabic · noun
- A trace; the mark something leaves behind.
- An effect or an impact.
Plural آثار āthār: traces, remains, antiquities.
Design partners
From traces to a safer tomorrow.
We're opening early access to a small group of design partners: SOC teams, managed security providers and forensic investigators in Qatar and the Gulf.
Or write to founder@atharsec.com
People · Privacy · Progress