The role of Qyronis
Qyronis is Nova's behavior analytics engine. It learns from activity in the customer's environment to build a history for identities, addresses, hosts, accounts and resources. It compares new activity with earlier behavior to identify changes that may need investigation.
Its output is evidence for investigation. A deviation is not proof of malicious intent, and insufficient source coverage is not represented as normal behavior. Confidence, reasons, freshness, coverage, and model state remain part of the result.
What Qyronis can assess
- Entity behavior
- Learns activity patterns for supported identities, addresses, hosts, accounts and resources.
- Anomaly assessment
- Compares current activity with prior behavior and presents deviation, confidence, and reasons together.
- Intent and sequence
- Identifies sequences of activity for investigation. A pattern does not by itself prove malicious intent.
- Asset drift
- Highlights meaningful changes in configuration, ownership, identity, or security context for supported assets.
- Exposure trajectory
- Shows how assessed exposure moves over time and which entities or conditions contribute to that movement.
- Connected intelligence
- Relates behavior, assets, exposure, and security outcomes when independent evidence refers to the same verified entity.
The Qyronis behavior cycle
-
01
Observe
Use source-linked activity for the selected entity and customer scope.
-
02
Learn
Build a behavior baseline when enough relevant history is available.
-
03
Compare
Measure rarity, change, and sequence against the prior entity behavior.
-
04
Assess
Attach reasons, confidence, freshness, coverage, and source references to the result.
-
05
Retain
Use learned history in later assessments while preserving the original events.
Truthful states for incomplete or changing evidence
- Learning
- History is still insufficient, so a score or verdict remains unset.
- Computed
- The applicable behavior assessment produced a result with supporting context.
- Not assessed
- Required evidence is absent or incomplete, so no normality claim is made.
- Degraded
- Processing completed with reduced evidence or capability and the limitation remains visible.
How to review a Qyronis result
- Confirm the entity, source scope, behavior window, baseline period, and current model state.
- Open the original activity and compare the change with expected business operations.
- Review confidence, coverage, freshness, source changes, and missing evidence.
- Use related alerts, threat context, cloud exposure, and ownership before deciding whether to investigate.
- Treat a Qyronis signal as context for hunting or investigation, not as an automatic alert or response instruction.