Platform
Built around the investigation, not the dashboard
Each capability exists to move one investigation from raw telemetry to retained organizational knowledge.
Alert triage console
Severity, risk score, source, identity and status in one filterable table backed by live queries — not a static list.
Evidence timeline
Each alert carries an ordered evidence chain: authentication failures, device novelty, process execution, network activity.
AI hypothesis evolution
An initial hypothesis is challenged with current evidence and recalled experience, producing an evolved assessment with a stated confidence.
Organizational memory recall
Relevant previous investigations are retrieved with a similarity score and the decision the analyst made last time.
Human decision gate
Confirm, reject or modify. A reason is mandatory, and the original and final hypotheses are both stored.
Outcome capture
Account isolated, credentials reset, endpoint quarantined, false positive or escalated — recorded against the investigation.
Immutable activity log
Every mutation writes an audit entry: analysis started, recall completed, hypothesis updated, experience retained.
Operational analytics
Severity distribution, decision mix and retained experiences over time, all calculated from stored records.