IOC analysis
Paste a log, an email, a report or any raw text: Galyct extracts the indicators of compromise (IPs, domains, hashes, URLs) and qualifies them automatically.
Module · Analysis & investigation
Analysis tools for emails, domains, URLs and indicators
The module brings together targeted checks designed to qualify a signal. Results are kept with their source and their limits; on their own they do not constitute an attribution or proof of compromise.
Understand the risk. Take back control. Stay the course.
Analysed in Europe · European sources · nothing sent outside the EU by Galyct in the standard configuration, apart from the RDAP bootstrap, which only transmits the domain name being analysed.
01 · THE TOOLBOX
Six analyses, one and the same requirement: your data stays in Europe
Faced with a suspicious signal, you do not need a lab: paste the artefact, Galyct analyses and qualifies it. Each tool produces a traceable verdict, added to the incident case.
Email header analysis
Paste the raw headers of a suspicious email: routing path, SPF / DKIM / DMARC authentication, sender inconsistencies and signs of spoofing.
Domain diagnosis
Check in a few seconds how well a domain is protected against spoofing and phishing: SPF, DKIM, DMARC and MX records, with recommendations.
Link analysis (sandbox)
Paste a URL received by email, text message or chat: Galyct opens it in an isolated environment (sandbox rendering). You never click on it yourself.
Watch & vulnerabilities (CVE)
Look up the context of a flaw (CVE) through European sources: criticality, available patches, known exploitation, scope affected.
Leak exposure
Check whether an address or a password appears in a known data leak, before it is used to attack you. Useful after an incident as well as for prevention.
02 · YOUR DATA STAYS IN EUROPE
Analysed in Europe. Not by the American giants.
Most analysis tools send your files and links to American platforms subject to the Cloud Act, in other words outside your control. Galyct relies on European sources and engines: your incident artefacts stay under European jurisdiction.
Available today
Analysis by fingerprint (hash) and correlation with European threat databases (CIRCL, abuse.ch and European open sources). Domains, links, headers and indicators are qualified without leaving the EU.
Coming soon: behavioural analysis of files & malware
A French analysis engine (detection by artificial intelligence) to dissect a suspicious file or payload, an alternative to the American platforms. Integration in progress: a step up for your investigation toolkit.
Coming soon
03 · DOCTRINE
An honest analysis tells the finding apart from the hypothesis.
A tool that says “dangerous” or “safe” without nuance exposes you. Galyct qualifies: what is established, what is probable, what remains to be checked, so that your decision rests on facts, not on a traffic light.
Each verdict is dated, sourced and added to the case. You keep a usable record of what you knew, when, and on what basis you decided.
04 · FROM SIGNAL TO DECISION
Each analysis feeds what comes next, nothing is lost
Investigation is not a dead end: indicators and verdicts flow back into the platform and become material for decisions.
1 · AnalyseThe artefactYou paste an email, a link, a log, a domain. Galyct extracts and qualifies.
2 · Build upIOC libraryIndicators accumulate in the session library, ready to be cross-checked.
3 · AttachIncident caseThe material joins the case and the timeline, traceable and timestamped.
4 · DecideCrisis cellThe cell has the context it needs to decide: isolate, notify, communicate.
05 · DELIVERABLES
What you get from each analysis
Not just a “green / red”: material that is usable, traceable and reusable for the rest of the incident.
Qualified verdict
Finding, confidence level, supporting material and limits, dated and sourced.
IOC library
Indicators extracted, accumulated and ready to cross-check with your other analyses.
Material for the case
Every result can be attached to the incident case and the timeline.
06 · WHAT WE DO NOT PROMISE
A serious analysis tool knows its limits
Credibility rests on careful qualification. No tool detects everything, and a “clean” verdict is never an absolute guarantee.
No 100% guaranteed detection
An unknown or targeted threat can slip under the radar of any automated analysis.
Not a substitute for an EDR / SOC
These tools qualify a one-off artefact; they do not replace continuous monitoring of the fleet.
The sandbox reduces the risk, it does not eliminate it
Isolated rendering avoids a direct click, but an analysis is still an analysis: caution remains in order.
See the investigation in your context.
A 30-minute live demo: analysis of IOCs, headers, domains and links and CVE watch, applied to a real case, and how everything flows into your incident case. No commitment.