About
EchoTrail
EchoTrail was founded in 2018 in Littleton, Colorado. It builds EchoTrail Insights, Windows process behavior data sold as an API, an MCP server, and a dataset license. A behavior lab runs new software continuously and adds what it observes to the record. The process pages are free to read; pricing covers the rest.
The data
Each record describes one Windows executable: the processes that launch it and the ones it launches, the paths it runs from, its hashes and code signers, and how common each of those is in real environments. The baseline is over 300 million process executions from production endpoints across many organizations; lab runs add software as it appears and keep the record current.
Over 2,500 process pages are free and growing. The full record covers over 40,000 executables and is one API key away.
Brian Concannon
EchoTrail is built by its founder, Brian Concannon, after twenty years of building detection systems at Raytheon, the FBI, CrowdStrike, and Expel.
Built EchoTrail Insights, the Windows process behavior dataset behind this site, and its API, MCP server, and free chat demo.
Led the team building detection infrastructure for a 24/7 SOC, transforming raw telemetry from diverse security tools into actionable, high-fidelity detections. Joined during Series C, contributed through Series D.
Joined as employee ~70 before the Falcon platform launched. Built CrowdStrike's first behavioral detection engine. Co-founded and led what became the Overwatch threat hunting team. Built streaming analytics processing millions of events per second.
Investigated nation-state cyber intrusions. Selected for the FBI Cyber Action Team (CAT) responding to the most complex cyber incidents in the country. Built automated analysis tools for large-scale network forensics.
Led real-time embedded software development in C++ for Navy satellite communications. Designed encryption subsystems for classified SATCOM.