Artifact Reference Guide

Understand the artifacts and objects that appear in your alerts and cases.

This guide describes all artifact types available in Radiant. Artifacts represent the people, devices, network objects, and other security-relevant items that appear in security alerts and cases. Understanding these types will help you investigate alerts, respond to threats, and define relationships between security events.

Artifact Categories

Artifacts are organized into the following categories to help you quickly identify the nature of the artifact:

• Identity & Access: Users, groups, roles, and permissions.

• Software: Applications, processes, and services.

• Network: IP addresses, connections, and infrastructure.

• Infrastructure: Physical and virtual devices.

• Data: Files, credentials, and data objects.

• Indicators & Response: Security indicators, CVEs, and containment actions.

Identity & Access Artifacts

These artifacts track who is acting within your environment, covering both human users and automated systems.

Artifact Type	Description
PERSON	Represents a real individual in your organization. Used to track human users with HR data like employee ID, department, and manager information.
IDENTITY	The base type for all accounts. Represents any account that can authenticate to systems. This is a parent type for both human and non-human identities.
HUMAN_IDENTITY	Represents a user account belonging to a person. This is the most common artifact type for tracking individual user accounts across different systems.
NON_HUMAN_IDENTITY	Represents service accounts, machine accounts, and automated identities (bots, API keys, system services).
GROUP	Represents security groups and distribution lists used for permission management.
ROLE	Represents roles that grant sets of permissions (e.g., "Administrator", "Viewer").
PERMISSION	Represents specific access rights or privileges (e.g., "Read", "Write", "Execute").

Software Artifacts

These artifacts track the applications and services running on your devices or in the cloud.

Artifact Type	Description
SAAS_APP	Represents cloud-based SaaS applications (e.g., Office 365, Salesforce).
NETWORK_ENDPOINT	Represents a network service or listening port (host:port).
URL_ENDPOINT	Represents web URLs and API endpoints (HTTP/HTTPS services).
NETWORK_ENDPOINT_ACTION	Tracks operations performed against network endpoints, such as authentication, reads, or writes.
PROCESS	Represents running processes on devices. Critical for tracking command lines and process trees.
LOGON_SESSION	Represents user login sessions across interactive, remote, and service logons.
HOSTING_SERVICE	Represents cloud infrastructure providers hosting your resources.

Network Artifacts

These artifacts track how data moves through your environment.

Artifact Type	Description
NETWORK_ADDRESS	Base type for IPv4 and IPv6 addresses, including geolocation information.
SRC_ADDRESS	The originating IP address in a network connection.
DST_ADDRESS	The target/destination IP address in a network connection.
FQDN	Fully Qualified Domain Names (FQDN). Represents domain names with subdomain breakdown.
DNS_RECORD	DNS resource records associated with domains.
NAMESERVER	Authoritative name servers for domains.
WHOIS_RECORD	Domain registration and ownership details.
ASN	Autonomous System Numbers (ASN), representing network ownership and routing.
NETWORK_CONNECTION	Traffic flows between source and destination. Critical for tracking lateral movement and C2.
NETWORK_INTERMEDIARY	Base type for network middle boxes. Represents proxies, VPNs, CDNs, and other intermediary services.
NETWORK_PROXY	HTTP/SOCKS proxies.
NETWORK_VPN	VPN endpoints and concentrators.
NETWORK_CDN	Content Delivery Network (CDN) nodes.

Infrastructure Artifacts

These artifacts represent the physical and virtual assets in your network.

Artifact Type	Description
DEVICE	Base type for all physical and virtual endpoints (computers, servers).
DESKTOP	Workstations assigned to users.
SERVER	Server systems.
MOBILEDEVICE	Smartphones and mobile phones.
TABLET	Tablet devices.
NETWORKDEVICE	Base type for network infrastructure.
ROUTER	Network routers.
SWITCH	Network switches.
OTDEVICE	Operational Technology and IoT devices.

Data Artifacts

These artifacts track the files and data being accessed or transmitted.

Artifact Type	Description
DATA_OBJECT	Base type for data and file objects. Represents various types of stored or transmitted data.
FILE	Files and executables, including hash information for threat intelligence.
EMAIL	Email messages and metadata, used for phishing investigations.
CLOUD_RESOURCE	Cloud storage objects like S3 buckets or Azure blobs.
CREDENTIAL	Base type for authentication credentials.
CERTIFICATE	X.509 digital certificates (SSL/TLS, code signing).
SECRET	API keys, passwords, and tokens.
OAUTH_TOKEN	OAuth 2.0 access and refresh tokens.
SAML_ASSERTION	SAML 2.0 tokens used for Single Sign-On (SSO).

Indicators & Response Artifacts

These artifacts relate to the detection and remediation of threats.

Artifact Type	Description
IOC	Indicator of Compromise (IoC). Represents evidence of malicious activity.
CVE	Common Vulnerabilities and Exposures (CVE). Represents known security vulnerabilities.
CONTAINMENT	Tracks remediation actions taken to contain threats.

Understand Artifact Deduplication

Radiant automatically identifies and merges duplicate references to the same entity across all alerts in a case. Whether it is a user, an IP address, a file hash, or a workstation, the platform consolidates them into a single, unique artifact.

This consolidation streamlines the investigation:

• Aggregates all alerts and evidence for a specific artifact into one row, eliminating the need to correlate dispersed data manually.

• Allows you to remediate an artifact once to apply the response globally across the case, rather than repeating actions for every alert.

• Shows exactly how many unique assets are involved, rather than inflating the count based on the number of alerts.

How it works

1. Within Alerts: Each raw alert contains multiple artifacts. Radiant consolidates them based on unique identifiers (like User IDs or IP addresses).

2. Across Cases: When you escalate multiple alerts into a Case, Radiant performs cross-alert deduplication.

Practical Example

Consider an investigation into a compromised account that spans three different alerts:

Alert 1: Failed login for user [email protected] from a suspicious IP (198.51.100.25) .

Alert 2: Successful login for user [email protected] from the same IP (198.51.100.25).

Alert 3: File sensitive_data.zip downloaded by user [email protected] from laptop LAPTOP-ABC.

Without Deduplication

You would see three separate [email protected] entries, two (198.51.100.25) entries, etc.

With Radiant Deduplication

The Case view displays a clean summary:

• 1 HUMAN_IDENTITY: [email protected] - Linked to all three alerts.

• 1 SRC_ADDRESS: 198.51.100.25 - Linked to alerts 1 and 2.

• 2 LOGON_SESSION: One failed, one successful - Linked to alerts 1 and 2.

• 1 DEVICE: LAPTOP-ABC - Linked to alert 3.

• 1 FILE: sensitive_data.zip - Linked to alert 3.

This immediately shows that the same user was involved in all events, and the same IP was used for both authentication attempts, painting a clear picture of the attack progression.