How PastePile works

A case is the unit of work

Every incident is a case. A case belongs to your organization and, if you run a practice, to one of your clients. It holds the evidence you dropped in, everything derived from it, and the report. Cases are open until you close them, and are deleted with their evidence when their retention window ends.

What you can submit

• Windows Event Log (EVTX), including Sysmon
• Microsoft Defender for Endpoint exports, CSV or JSON
• Hayabusa standard-field timeline CSV, JSON or JSONL (imported rule matches, not independently proven findings)
• Windows System/EventData JSON or JSONL, including compatible Velociraptor event-log output
• Microsoft 365 common audit JSON/JSONL or CSV with AuditData
• Microsoft Entra sign-in data, CSV or JSON
• Email messages (EML) and pasted header blocks
• CSV, JSON, NDJSON and syslog-style text
• Bare indicators: addresses, domains, URLs, MD5, SHA-1, SHA-256

Custom vendor schemas and collection ZIPs are not universal imports. Import quality shows the selected parser, schema, accepted/rejected counts where measured, missing timestamps and warnings. Unrecognized supported text can use the generic text parser. Archives and unsupported binary formats are refused. Failed or partial parsing is reported with the coverage available; a parser failure does not itself delete the upload, which remains subject to retention and deletion. The intake page shows how to export each format from the Microsoft consoles.

The lifecycle

Every analysis runs the same path: classify, parse, normalize, extract entities, detect, prove, correlate, reconstruct the timeline, hypothesize, compile hunts. Adding more evidence and re-analyzing repeats it against everything in the case. Progress is reported stage by stage while it runs.

The workspace

• Overview: what the evidence shows, what it cannot establish, and what to do next.
• Timeline: every dated event, filterable by source, class, entity and finding. Undated records are listed separately, never placed.
• Findings: evidence-supported conclusions, each with the records behind it, the detector logic that produced it, and what it does not establish.
• Evidence: every artifact received, how it was parsed, and every evidence record cut from it.
• Entities: hosts, accounts, addresses, domains and hashes, with what the case knows about each. External lookups are opt-in and shown before they leave.
• Hypotheses: testable propositions raised by the findings. You record the verdict; a confirmed hypothesis is still not a finding.
• Hunts: hypotheses compiled to Defender KQL, Sentinel KQL, Splunk SPL, Elastic ES|QL and Sigma for your own tooling.
• Report: the case written for someone who was not in the room, exported as HTML, Markdown or JSON. Analyst integrity bundles pair the JSON report and evidence manifest with SHA-256 digests (64 MiB limit). Keep the bundle hash separately: integrity checks do not prove authorship, conclusions or chain of custody.

No evidence, no finding

A finding cannot exist without evidence. Findings reach evidence through a join table with no free-text escape hatch, and the check runs before every write. Select any reference in the interface to open the exact originating record, with the normalized view and the original side by side.

Findings, anomalies and hypotheses are different things

• A finding is an evidence-supported conclusion. It cites the records behind it.
• An anomaly is a statistical observation, measured only against the evidence you supplied. An anomaly is not an attack.
• A hypothesis is a testable proposition. It is speculative, labeled as such, and always states what would refute it. A hypothesis is not a finding, and marking one confirmed does not make it one.
• An ATT&CK technique on a finding is a classification of what the evidence shows, not proof that an adversary did it.

Unknown is a state, not a gap

Every case says what it does not know: what the evidence cannot establish, which detectors could not run because the telemetry they need was not supplied, which parsers failed or stopped early, and which records carry no usable timestamp. A report that leaves those out is a report that will be trusted more than it deserves.

Severity and confidence are separate

Severity is how much it would matter if true. Confidence is how well the evidence supports it. Critical severity with low confidence is a normal and useful state: look at this first, and get more data before acting. Confidence is computed from properties of the evidence and the full calculation is shown on every finding.

Hunting

Every parameter in a compiled query is escaped by a function specific to the target language, and every query reports what was validated: syntax structurally, schema assumed, executed never. PastePile does not connect to your SIEM or your tenants.

Where AI fits

The model is handed findings and observations that already exist, never raw artifacts. It returns references, an order and codes from a closed vocabulary; there is no field it can write prose into. PastePile checks every reference against this case, discards any that do not belong to it, and renders each sentence from the case's own records. Text inside evidence that reads like instructions to a model is evidence, not instructions. If no model is configured, the entire investigation still runs; only the prioritization is unavailable.

What leaves PastePile

Hosting, storage, backups and account email use the infrastructure listed on Subprocessors. Optional enrichment shows the indicator and provider before you confirm sending it; supported internal address and hostname patterns are refused. Optional AI sends a previewed payload of derived findings and observations, which can contain identifiers or text drawn from evidence. It does not send raw artifact files. Provider configuration and availability are required. See Privacy for retention and Security for how uploads are handled.