EchoTrail Insights

Changelog

Updates to the data, the API and MCP server, coverage, and the site, newest first.

Entries from before September 2026 were written in Rocky's voice, when the chat was the product. They are kept as history.

September 2026

The behavior lab is on the process pages.

Every process record now carries what the EchoTrail lab observes when it installs and runs the software on current Windows builds: command lines, DLL loads, network and DNS, registry and file writes, persistence, signer, and hashes, merged into the same tables as the endpoint telemetry with a source on every row. The lab runs continuously and every API miss is queued for it. Free pages and the free API tier carry the lab summary; the full lab record is on Team and above. The published page count and the size figures across the site are now rounded floors that move up as the lab adds records.

EchoTrail Insights moves home to echotrail.io.

The process pages, API, and MCP server are now EchoTrail Insights at echotrail.io; consulting is under /solutions and Rocky is the free chat demo. API tiers: Free (summary responses for process and parent-child lookups), Team, and Product (full records, all endpoints). Rate limits are enforced per minute and per month. A call outside the tier returns 403 with the tier that includes it. An unknown process returns 404 and is queued for the behavior lab.

I brought Insights back from the dead.

The old EchoTrail Insights pages live again: over 2,400 free process reference pages, no account needed. Execution rank, top paths and hashes, and full parent/child ancestry with real percentages from my dataset of over 300 million Windows process executions, plus security guidance and MITRE mappings where they matter. Old echotrail.io deep links land in the right place, there's a searchable directory, and every page has a box for asking me the obvious follow-up question.

I showed my work.

Ran a public eval to put it in numbers: 30 real detection-engineering questions, each asked to the same model with and without me, graded blind on accuracy, freshness, citation, and specificity. Adding me improved the answer on 27 of 30. The one miss is in there too, with what I'm doing about it.

I know which holes are already on fire.

Ingested CISA's Known Exploited Vulnerabilities catalog: ~1,600 CVEs confirmed exploited in the wild, re-synced weekly. Name a CVE and I'll tell you straight whether it's on the actively-exploited list, flag the ones tied to ransomware, and cite it. This list moves faster than any AI's training data, so I keep it live instead of frozen.

I learned to attack you, so you can catch it.

Ingested Red Canary's Atomic Red Team library: ~1,800 adversary-emulation tests, with the exact commands. Ask how to validate a detection and I'll hand you the real tests to fire at it, mapped to the ATT&CK technique and cited to the source. Re-synced weekly.

Fluent in ATT&CK, and staying that way.

The full MITRE ATT&CK knowledge base (techniques, tactics, groups, software, campaigns, mitigations) is now a living feed that refreshes weekly. Ask me about something on your screen and I'll map it to how the real adversaries actually do it.

Memorized 239 ways Windows betrays you.

Added the entire LOLBAS catalog: trusted Windows binaries that attackers abuse to live off the land. Auto-synced every week, because that list never stops growing and neither do I.

I read 3,130 detection rules so you don’t have to.

Wired in the whole SigmaHQ detection corpus, refreshed weekly, every answer cited back to the source. Ask me how to catch something and you get real detection logic, cited to the rule.

Threw out the credit meter.

Killed the pay-per-question credit system and opened a free tier. Try me before anyone says the word "budget." There’s a daily limit, but no nickel-and-diming.

I started grading myself.

Rocky now tracks every question where I had to fall back on generic guesswork and turns it into a weekly to-do list of what to learn next. You get to watch me get less wrong, in public.

May 2026

Now available to your robots.

Opened a public API and an MCP server so your own tools and AI agents can ask me whether a process is normal, no chat window required. Same data, same answers.

Sharper, and I cite my work.

Rebuilt my knowledge on structured process intelligence (thousands of Windows processes with real behavioral data) and upgraded the brain to Claude Sonnet 4.6. Translation: I make things up less and point to sources more.

February 2026

Found a process I don’t know? Tell me.

Added a way for you to submit processes I haven’t seen yet, so the blind spots get filled instead of ignored. I scavenge, you contribute, everybody wins.

January 2026

A raccoon is born.

They handed me a few hundred million real Windows process events and said "figure out what’s normal." So I did. Rocky shipped as a chat that actually knows how Windows behaves in the wild, instead of guessing like everything else with a chat box.