Every capability, with its real status
57 capabilities: 22 available, 21 need configuration, 9 partial and 5 planned. Open any one for the detail.
AI investigation
- Automatic alert investigation loopAvailable
- Security AI: rule and memory resolution before any LLM callAvailable
- Multi-provider LLM with failover, local models and built-in fallbackConfigurable
- LLM usage log, token budgets and per-tenant LLM policyAvailable
- Decision thresholds with logged justificationAvailable
- Similar past incidents memoryAvailable
- AI analyst chat grounded in platform dataConfigurable
- MCP server: 23 SOC tools for external AI clientsConfigurable
- MCP Gateway: 38 tool services in four risk tiersConfigurable
- Agent roster (8 control agents + 5 specialists)Partly built
- Machine learning: Isolation Forest anomaly modelPartly built
- Semantic embeddings for similar-incident memoryConfigurable
Response
- ATT&CK-guided workflows: 1,412 investigate and respond runbooksAvailable
- 108 one-click prompts for the AI playbook generator (9 categories)Configurable
- SOAR playbooks: 58 built-in, builder, AI generator, approvals, rollbackAvailable
- Live response actions (EDR, identity, firewall)Configurable
- Case management with SLA, evidence chain and reportsAvailable
- Ticketing sync: TheHive, ServiceNow, Jira, GLPI, ZammadConfigurable
Deployment
- Database fallback, warm-standby mirror and automatic sync-backAvailable
- Ingestion throughput: measured and configured limitsPartly built
- Attack graph on Neo4j (optional)Configurable
- Docker, Windows and Linux deploymentConfigurable
- PostgreSQL with replication and failoverPartly built
- Benchmarks, uptime figures and scale numbersPlanned
Detection
- Detection rule catalog: 103 built-in plus 1,293 imported Sigma rulesAvailable
- Behavioural correlation and kill-chain progressionAvailable
- Detection quality feedback (false-positive rate per source)Available
- MITRE ATT&CK mapping and navigatorAvailable
- UEBA statistical anomaly scoringAvailable
- Threat intelligence enrichmentConfigurable
- Threat hunting workbenchConfigurable
- External attack surface monitoring (passive)Configurable
- Behaviour baselines from your own alert historyAvailable
- CISA KEV and EPSS vulnerability evidenceConfigurable
Integrations
- Elastic SIEM real-time ingestionConfigurable
- Splunk connectorConfigurable
- Wazuh connectorConfigurable
- Generic webhook receiver and event ingestion APIConfigurable
- IBM QRadarPartly built
- Microsoft SentinelPartly built
- EDR detections (CrowdStrike, SentinelOne)Planned
- Native Palo Alto / Fortinet firewall connectorPlanned
- Windows event collector and Linux agentPartly built
- REST API, OpenAPI docs and live WebSocket feedAvailable
- Email (SMTP) and Microsoft Teams notificationsConfigurable
- Outbound alert forwarding webhookConfigurable
Security
- JWT authentication with bcrypt password hashing and refresh tokensAvailable
- Role-based access controlAvailable
- Tenant-scoped data and policyAvailable
- Hash-chained audit trail for AI and response activityAvailable
- Masking of secrets and personal data before external LLM callsAvailable
- MFA and enterprise SSO for operator loginPlanned
- Compliance certifications and independent auditsPlanned
See it on your own alerts.
Book a walkthrough with the team. We will show the platform end to end, tell you what is production-ready and what is not, and discuss how it would sit next to your existing SIEM.