Organized around the work, not the industry.
Six kinds of investigation work, each producing the same connected record: evidence with its sources, a reconstructed sequence, stated uncertainty and a decision with a name on it.
SOC alert investigation
First-line and second-line review of the daily queue.
- Each alert opens as a Matter with its source evidence already collected
- Known facts, contradictory evidence and unresolved questions are kept apart
- Alerts closed as reviewed-benign keep the reasoning and stay reversible
AI may collect, correlate, summarize, score confidence, and draft; every matter receives human review; AI cannot close critical matters alone.
Identity compromise review
Sign-in anomalies, MFA fatigue, OAuth grant abuse, session reuse.
- Sign-ins, token grants and session activity collected against one account
- Improbable travel and legacy authentication placed in sequence, not asserted
- Session suspension and credential resets recommended, never executed unattended
AI may collect, correlate, summarize, score confidence, and draft; every matter receives human review; AI cannot close critical matters alone.
Endpoint and cloud investigation
Process activity, persistence, control-plane and data access.
- Process and parent-child records connected to the detection that raised them
- Cloud audit and control-plane activity tied to the same principal and window
- Links with no supporting record are listed as open questions, not drawn as facts
AI may collect, correlate, summarize, score confidence, and draft; every matter receives human review; AI cannot close critical matters alone.
MSSP multi-tenant case review
Providers documenting investigation work per client.
- Per-client scoping with role-based access to each tenant's record
- One connected Matter per client, without losing context between them
- Client-ready briefs drafted from the same record the analyst reviewed
AI may collect, correlate, summarize, score confidence, and draft; every matter receives human review; AI cannot close critical matters alone.
Executive incident communication
What leadership is told, and what it rests on.
- Impact, scope, what is known and what remains unresolved in one page
- Drafted from the Matter rather than retyped from memory
- Reviewed by a named analyst before it is sent
AI may collect, correlate, summarize, score confidence, and draft; every matter receives human review; AI cannot close critical matters alone.
Compliance evidence preparation
Audit and regulatory requests about incident handling.
- Evidence, decisions and approvals exported as one pack
- Mapped to SOC 2, ISO 27001, PCI DSS and NIST CSF control references
- Immutable history of who decided what, when, and on which evidence
AI may collect, correlate, summarize, score confidence, and draft; every matter receives human review; AI cannot close critical matters alone.
Bring us one investigation.
Tell us which of these six the queue is stuck on, and we walk one real alert through collection, reconstruction and approval.