Live response actions (EDR, identity, firewall)
Response actions run in simulate mode by default. Live mode is opt-in (RESPONSE_MODE=live) and needs a configured provider: Wazuh, CrowdStrike, Microsoft Defender, Entra ID, Okta or a firewall webhook. Protected targets and a per-hour cap are supported.
Status
Configurable
Built and ready. Bring your own keys, models or connected systems and it works; without them it stays idle.
See it on your own alerts.
Book a walkthrough with the team. We will show the platform end to end, tell you what is production-ready and what is not, and discuss how it would sit next to your existing SIEM.