About Quartermaster

Quartermaster is building a real-time, distributed maritime awareness network. Its SmartMast sensors turn working vessels and commercial fleets into a real-time maritime awareness layer, filling in the gaps in maritime visibility vessel by vessel. More than 650 vessels in 25 countries now host a SmartMast System designed to provide awareness of what’s happening on our oceans. Security is led by AJ Cardarelli, Head of IT and Security, whose team covers everything from corporate IT to the SmartMast systems deployed at sea.

The problem

Quartermaster had an existing stack of individual security tools: a cloud security tool, an endpoint tool, an identity provider, and an OT monitoring tool on the SmartMast units. Each tool raised alerts without knowing what the others were seeing, and all of them fed into the company’s data lake. Many of those alerts were noise, from threat intelligence feeds to device-management software that looked like malware to the endpoint tools. Each alert still needed triage and investigation, which kept the team reacting instead of doing proactive security work.

The OT sensor network was the company’s largest attack surface by far. Few OT security products are built for hundreds of small systems spread across vessels. OT data from the SmartMast units had no hostname attached, so alerts were hard to tie back to the vessel they came from. AJ wanted visibility and detection the team could act on across the fleet, where much of the data arrived in non-standard formats.

The team also wanted a platform that would take the first level of analysis off its plate. That way it could keep a small team of generalist security engineers instead of hiring tier-one and tier-two analysts. With the fleet growing and every new SmartMast adding its own data and alerts, hiring analysts would never have kept pace.

After a rigorous evaluation that narrowed a field of platforms to three and tested each against Quartermaster’s live data for a month, the team chose Artemis.

How Quartermaster uses Artemis

Use Case 1: Detection and investigation across the OT sensor fleet

Before Artemis, an OT monitoring tool watched the SmartMast units and sent its alerts to Quartermaster’s data lake. Each alert named the sensor appliance that saw the traffic, but not the device it came from. The team had to work out by hand which of hundreds of masts was involved. Even then, the alert could not be correlated to anything else the team knew about that device.

Artemis built a new connector for the OT monitoring tool during the evaluation and had it live within a day. Within a week of connecting the first sensor data, it had automatically built and tuned 20+ detectors for fleet activity, starting from none. Artemis ties every OT alert to the vessel it came from and keeps that up to date as masts join the fleet. It also went back through earlier OT alerts and matched existing alerts to their vessel.

Each OT case is investigated the way the team would work it, following Quartermaster’s own investigation procedures. OT alerts now arrive with the vessel and its recent activity already attached. The company’s largest attack surface went from its least visible to one of its best covered. OT activity now sits alongside identity, cloud, and network data in Artemis, so the team can follow an incident from a corporate account to a mast at sea.

Use Case 2: Autonomous investigation and response that narrows every alert to the few cases that matter

Before Artemis, every alert that reached the data lake needed a person to decide whether it mattered. Noisy threat intelligence and false alarms on device-management tools took the same attention as real signals. AJ’s goal was to avoid hiring tier-one and tier-two analysts at all, and instead hire generalist security engineers who could spend more of their time on incident response. Of the roughly 500 alerts a day coming from the team’s tools, he wanted only a handful left for a person to review, with Artemis investigating and responding to the rest autonomously.

With Artemis, every alert is now investigated before anyone sees it. Only the cases that need a decision reach the team, each with the timeline, the evidence, and a judgment. When action is needed, Artemis can take it within the approvals the team sets. Artemis also cuts the noise on its own: it worked out that a recurring endpoint alert came from the company’s device-management software and stopped raising it, without anyone writing a rule.

In the first 30 days, Artemis ran more than 2,600 investigations for Quartermaster and surfaced only the handful of cases that required action. When the team disagrees with a call, it adds context to the case, and Artemis improves from that feedback. Together, that gives a small team the coverage of an analyst tier without hiring one.

Use Case 3: Detection and investigation on top of Quartermaster’s existing data lake

Quartermaster’s data lake already held most of its security data, including web gateway logs, endpoint vulnerability data, and custom application logs from its engineering teams. AJ wanted to keep the data lake as the team’s central store. Rather than wiring every feed a second time, he wanted Artemis to pick up any new custom log as soon as it landed in the data lake.

Artemis detects and investigates directly on top of the data lake. It uses hybrid analytics to ingest what it needs for detection and federate queries across the rest of the data where it already lives. Quartermaster also connected its cloud, identity, and SaaS tools directly. Most of that setup was self-serve. AJ connected about a dozen sources on the first day of the evaluation, and by day four the team had 32 log sources connected to Artemis.

Much of what sat in the data lake came from OT sensors and agents the developers had set up, in formats no off-the-shelf parser covered. Artemis learned each format within the first week, and the team never wrote a parser. Now any new log source the team sends to the data lake is parsed automatically and covered by Artemis’s detections and investigations.

Use Case 4: Data loss prevention for the company’s most sensitive data

Quartermaster handles sensitive data, and the team wanted better detection of data loss. AJ wanted more visibility into what users do with that data, including behavioral activity that might not look like an attack but could still signal risk.

Artemis now detects the behaviors that signal insider risk, such as large transfers to personal email, files switched to public access, and company documents syncing to personal accounts. For data loss prevention, AJ used AI Mode to write an investigation in plain English that now runs as a daily hunt. The team also used AI Mode to build a custom dashboard of risky user activity and data loss in plain English.

Artemis goes further and proactively monitors the security posture of the company’s most sensitive data. It learned how those protections are configured and automatically built a detector that alerts the team to any change that weakens them.

The Result: Full coverage from corporate IT to the fleet at sea, without adding analysts

Artemis connected 32 log sources in four days, had 20+ OT detectors running within a week of the sensor data arriving, and ran more than 2,600 case investigations in 30 days.

Quartermaster’s team now runs detection and investigation on top of the data lake it already had, and OT data that used to be unusable now produces cases tied to specific vessels. With first-level triage handled, AJ and the team spend their time on decisions, incident response, and hardening.

Get started with Artemis

Artemis is the AI-native platform for security operations, helping you detect and stop attacks at machine speed. It connects to more than 270 sources across cloud, identity, endpoint, and SaaS, through ingestion or federated access, and runs detection engineering, threat hunting, investigation, and response on one platform. Artemis autonomously builds and tunes detections for each environment. Teams use it to replace legacy SIEMs outright or to run alongside the tools they already have. To see it in your environment, request a demo at artemissecurity.com.