What is harmful is taken apart.

HookMesh routes every file through CDR and the tools you already run, in the order you decide.

What is useful is put back.

Content Disarm and Reconstruction returns a clean copy of the document, not a verdict about the old one.

One route for every file you already handle.

Mail, shares, upload forms. Verdicts go to your SIEM, SOAR and ticketing through the API.

HookMesh is set up with you, around a file type you actually receive. Ask for a demo and we build the first route together.

Get a demo

Every source gets its own route.

Mail, upload forms, file shares. Each is a flow you build from controllers and modules, in the order you want. Verdicts leave through the channels your team already watches.

Controllers

  • Extension Check
  • File Size Check

Modules

  • Static Scanner

Modules

  • CDR
  • Email alerts
  • API
  • SIEM
  • SOAR
  • Issue trackers

Questions we get asked

What does HookMesh add to Threat.Zone and CDR?

The workflow between them and the connection to the rest of your stack. HookMesh decides what happens to a file in which order, and reports the result where your team already looks.

Can I change the order of the steps?

Yes. Controllers, then Static Scanner, then CDR is the default. You can reorder or drop blocks per source, so mail attachments and upload forms need not follow the same route.

How do alerts reach my team?

By email, and through the API into SIEM, SOAR and issue trackers.

What is CDR?

Content Disarm and Reconstruction. Instead of deciding whether a file is malicious, it removes everything that could act and rebuilds a usable copy. It handles more than 50 file types.

Is there a trial?

HookMesh is set up with you, because the workflows depend on your sources and tools. Ask for a demo and we will build one around a file type you actually receive.

Design the workflow. We run it.

Tell us which files arrive where. We will build the route with you and show a real document going through it.

Get a demo