A video of the session
Each case keeps a video of the session. You play it back in the case. You download it in MP4 format.
Open a suspicious link in a disposable browser
Paste a suspicious link. livewells opens it away from your network. You drive the page. You keep the evidence.
- See where the link goes: the redirect chain, the domains and the IP addresses.
- Keep a video of the session. Play it in the case or download it in MP4 format.
- livewells integrates with seven intelligence sources and shows which ones ran.
livewells handles links today. Support for email files, QR codes, HTML attachments, PDFs, Office documents and password-protected archives is planned, by upload or API. Office documents are analysed without running their macros.
One plan for your full security team. See pricing.
How it works
Paste a suspicious link
Paste it into the livewells box. livewells unwraps redirect wrappers and finds the final address. You see a preview before anything opens.
Choose what to remove
livewells finds the recipient's details in the link. You choose to remove them or keep them. Some pages show their content only with them.
Drive the page
The page opens in a disposable browser, away from your machine. You click, scroll and type. A session lasts 15 minutes at most.
Keep the evidence
When the session ends, the case holds a video and a defanged report. You play the video or download it. You set the verdict.
What each case holds
Redirect chain
Each hop from the first link to the last page.
Domains and IPs
Each domain the page contacted, with the IP address of each domain.
Defanged indicators
All indicators on screen, and in the CSV and JSON reports, are defanged. Each indicator is plain text.
hxxps[://]login[.]example[.]test/a
The raw network log keeps the original values, and a label says so. Copy raw asks before it copies.
API and webhooks
Start a session with a link and read the report from your own tools. Signed webhooks tell you when a session ends. In the API, a session is called a run. A person drives the browser.
Microsoft Entra ID sign-in
Your analysts sign in with your Microsoft Entra ID. Your Entra administrator approves livewells one time.
Enrichment from seven sources
livewells integrates with seven sources. For each case, livewells shows which sources ran.
MaxMind GeoLite2
Where an IP address is, and which network owns it.
IPinfo
A second view of the location and network owner of an IP address.
IP2Location IP2Proxy
If an IP address is a VPN or a proxy.
ipapi.is
More context on an IP address, with hosting and VPN flags.
AbuseIPDB
Abuse reports that other people filed about an IP address.
Google Web Risk
If Google lists a domain or a link for phishing or malware.
abuse.ch URLhaus and ThreatFox
Known malicious links, domains, IP addresses and file hashes.
Enrichment runs only for sources that livewells has switched on. The case names the source of each entry. Outside services receive only an IP address or a short hash prefix. A source that reports nothing gives context, and your analysts decide.
What livewells handles
livewells handles links today. Support for email files, QR codes, HTML attachments, PDFs, Office documents and password-protected archives is planned, by upload or API. Office documents are analysed without running their macros.
- livewells opens each link in a disposable browser, and you drive the page.
- The report shows what the browser observed. When it observes nothing, the report says "nothing observed".
- A cloaked page can look harmless to a sandbox, so your analysts read the report with care.
- Your analysts set the verdict. Enrichment gives them context.
Privacy and isolation
Your data is yours
Your cases are visible only to your organisation. Your content stays yours.
Own database, own key
Each customer's data is in its own database. Each customer's files are encrypted with a key for that customer.
A disposable browser for each session
Each session runs in its own disposable browser. livewells checks the browser sandbox when a session starts. If the check fails, livewells stops the session before it starts. livewells gives the submission back, 10 a day at most for each organisation.
Where data is placed
We ask Cloudflare to place stored data in Oceania. This is a best-effort request. Cloudflare decides the final placement. Session browsers run where Cloudflare places them. If you must have Australian residency, tell us before you sign up.
Threat data
Your cases are visible only to your organisation. De-identified details from confirmed-malicious cases can help improve livewells. You can exclude a case, or all cases.
We can use de-identified data from cases that your analysts confirm are malicious. We use it to improve detection, to train livewells detection models and to build a livewells threat feed.
The data holds the attacker's hosts, addresses and file hashes (defanged), the page structure, the enrichment results and the verdict. Customer, analyst and recipient identities stay out of it.
We use only cases that you mark malicious. Excluded cases, screenshots and video stay out of it. You can exclude all cases of your organisation from threat data, or exclude each case.
You control retention
Your organisation's administrators set how long livewells keeps cases. To delete a case sooner, write to sales@livewells.io. The audit log records all sessions. You can export it.
Pricing
livewells
A$699 a month
or A$6,990 a year (two months free)
- Unlimited analysts in one organisation
- 500 submissions a month
- 3 concurrent sessions
- Want more? Top-up: +250 submissions in the current month, A$149
One submission is one session, 15 minutes at most. The monthly limit is hard. A top-up adds submissions.
Prices are in Australian dollars and exclude GST. For Australian customers, 10% GST is added at checkout. Overseas customers (including the US) pay no GST.
Contact
Write to sales@livewells.io. Maelstrom AI makes livewells in Australia.