01
Built for the regulator's question
When someone asks what happened and who decided, the timeline, the evidence and the approvals are already in one place.
Triage
The incident and its evidence, in one record.
Signals arrive in a queue with priority and ownership. Cases keep an append-only activity timeline next to the evidence, so the story of the decision is recorded as it happens — not rebuilt for the audit.
MON 02:1147 spaced login probes across 9 accountsT1110.003
WED 21:14Success on intern account via Tor exit · MFA stale 47 daysT1078
WED 21:18Finance shares enumerated · zero files openedT1083
WED 21:19Account disabled · approved by s.iyer · playbook run loggedSENSITIVE
PROPOSED RULE · BACKTESTED ON YOUR HISTORYtor-vpn-success-after-spray · below promotion threshold · awaiting analyst review
How it works
The record of the decision, as it is made.
- Priority, ownership and scope from the first minute.
- Append-only case timeline.
- Graph evidence, events, logs and threat intel linked inside the case.
02
Per-tenant queues for managed services
An MSSP sees each client's queue inside that client's tenant boundary. Priority, ownership and scope never cross tenants.
Specifications
| Timeline | Append-only |
|---|---|
| Linked evidence | Graph, events, parsed logs, threat intel, AI reasoning |
| MSSP | Per-tenant queues |