How it works
From your configuration to a ranked list of fixes.
Bonanza reads your environment and your detection, checks every step of every path, and tells you what to fix first.
001 Every step gets a state
Covered by at least one detection rule.
A rule exists, but the log it needs has not arrived.
No detection coverage. These rise to the top.
Collected, but no rule uses it.
A rule fires so often that the alert gets ignored.
002 Remediation
Fix the few things that close the most paths.
For every invisible step, Bonanza lists the fixes that would make it seen or remove it, then ranks them by how many invisible steps each one closes across all your paths. One good fix often closes many paths at once.
Add a detection rule
Cover the technique behind an invisible step, so the SOC sees it.
Add a log source
Collect the log a step needs, or put dark data you already collect to work.
Cut a hop
Isolate the step, so the path no longer reaches the crown jewel.
Every fix comes with its reason: the step it closes and the paths it affects. Try any of them as a what-if first.
003 What if
Test the change before you make it.
Pick a planned change. Bonanza adds it to a copy of your graph, finds the new attack paths it opens, and re-ranks everything by whether your detection would see them. Nothing changes in production.
Hover or tap any node or hop to see why.
Paths to the crown jewel, ranked
Illustrative example, not customer data.
004 Under the hood
A deterministic engine. Answers you can prove.
Bonanza's deterministic engine runs graph algorithms over your real permissions and detection rules. Every verdict traces back to a specific rule, log source or permission, so your SOC can verify it, your auditor can check it and your board can act on it. No probabilities, no black box.
Deterministic
Same input, same result. Run it twice and you get the same paths in the same order.
No probability
A step is covered by a rule or it is not. Nothing is estimated or sampled.
Traceable
Every path is shown step by step, with the rule that sees it or the gap that hides it.
005 What Bonanza models
Your whole environment, on one map.
- Users, groups and identities
- Computers and servers
- Domains, containers and trust relationships
- Permissions, access paths and sessions
- Entry points and high-value assets
- Certificates and certificate authorities
- Network devices and firewalls