MARS
Product

A working console, not a demo.

Eleven pages cover the analyst's day, in Traditional Chinese and English, light and dark.

The console, on real output

Captured from a local MARS instance analysing synthetic emails and synthetic XDR incidents with a Claude model. No real mail, devices or accounts appear.

Analysis history: three synthetic emails and the verdict MARS published for each.
Analysis history: three synthetic emails and the verdict MARS published for each.
One analysis in full: who sent it, the AI's verdict and reasoning, recommended steps, cautions, and questions for the reporter.
One analysis in full: who sent it, the AI's verdict and reasoning, recommended steps, cautions, and questions for the reporter.
Indicators extracted from the email, ready to copy or export.
Indicators extracted from the email, ready to copy or export.
The XDR incident queue: three synthetic incidents, each with the evidence for and against, the data gaps and the next step. In all three the AI's confidence was under the threshold, so MARS left the final decision to an analyst. This instance had no connection to Defender for Endpoint, so hunting queries could not run; the data gaps shown include everything those queries would have answered.
The XDR incident queue: three synthetic incidents, each with the evidence for and against, the data gaps and the next step. In all three the AI's confidence was under the threshold, so MARS left the final decision to an analyst. This instance had no connection to Defender for Endpoint, so hunting queries could not run; the data gaps shown include everything those queries would have answered.
One incident in detail: what happened, why it matters, the next steps and the key evidence, with every gap stated.
One incident in detail: what happened, why it matters, the next steps and the key evidence, with every gap stated.

Console pages

Mail report overviewReport volume, results and mail waiting for a person.
Mail analysisUpload a message file and analyse it now.
Mail historySearch and filter completed analyses.
Mailbox monitoringBring in new mail from the reporting mailbox.
AI processingCases being analysed, with their progress.
XDR incident queueReview and triage incidents.
Advanced analysisExposure, hotspots and risk across incidents.
RemediationReview proposed actions, run them, confirm the result.
IOC databaseManage indicators and sync outside intelligence.
SandboxOpen suspicious links in isolation.
AI qualityManage validation cases and track judgement quality.
Command lineThe same analyses run from a terminal.

Connected services

MICROSOFT

Microsoft 365 mailDefender XDRDefender for EndpointEntra ID

THREAT INTELLIGENCE

VirusTotalAbuseIPDBURLhausThreatFoxMalwareBazaarPhishTankSTIX/TAXIICISA KEV

AI MODELS

AnthropicOpenAIGeminiLocal modelsCompany gateways

NOTIFICATIONS

EmailTeamsSlack
Deployment and data

Your host, your data.

MARS is built for teams that cannot hand their mail to someone else.

Self-hosted

Analysis records and audit logs stay on the organisation's own host.

Controlled AI endpoints

The host administrator sets which AI endpoints may be reached. The console cannot widen the list.

Four roles

Read-only, analyst, SOC analyst, administrator. Secrets never appear in the console.

Offline updates

A host with no internet access can still be updated, with verification, a dry run and a backup first.

Little to operate

One instance with an embedded database, sized for one security team.

Open source

Released under the GNU AGPL, version 3 or later.