Reach an analyst
For when something is already happening: an incident tracked to a stated conclusion, volatile state captured before it disappears, and a person to talk to.
What people come here for
Incident Management
Seven states, including stopped without explanation — because that is what actually happens to incidents. Detection delay is measured from the first event, not from the moment somebody got around to opening a ticket.
Full definition →Forensics
Captures processes, sockets, ARP entries, kernel modules, mounts and sessions in RFC 3227 order of volatility, and records the privilege ceiling it actually reached rather than the one it wanted.
Full definition →Threat Hunting
A hypothesis comes back one of three ways: found, not found within a stated time horizon, or impossible to ask with the data available. The third answer is the one most tools quietly turn into the second.
Full definition →Orchestration Playbooks
Playbooks limited to safe actions — evidence capture, incident notes, tickets, approval requests. A containment step can be declared in a playbook and is always refused when it runs here.
Full definition →Automated Response
Detection triggers and response actions are kept separate. On a real detection this issues a notification and reports the attempt honestly, instead of claiming an effect it did not have.
Full definition →Everything else in this surface
Each name opens its own one-line definition in the capability catalogue.
What this does not do
Automated response here means an alert reaches you. Anything that acts on your own production is a separate protection you arm yourself, behind its own signed consent.
Everything this product does not do →