SOC Operations
4 modulesMSS Procedures
Managed security service runbooks, escalation paths, and standard operating procedures for shift work.
SOC Triage Playbooks
Step-by-step alert triage workflows by detection category, severity, and escalation criteria.
SOC Comms Builder
Generate consistent client notifications, incident updates, and handoff summaries from templates.
ASM Dashboard
Attack surface management view of external assets, exposed services, and newly discovered risks.
Stack
6 integrationsCrowdStrike
Falcon console for endpoint detections, host management, and real-time response sessions.
PagerDuty
On-call schedules, paging policies, and incident escalation across the analyst rotation.
Umbrella
DNS-layer security, domain reputation lookups, and web filtering policy management.
Avanan
Email security console for phishing detections, quarantine review, and message trace.
Okta
Identity provider administration, session review, MFA resets, and sign-on policy checks.
Microsoft
Defender XDR, Entra ID, and M365 security portals for cloud and identity investigations.
Triage Tools
5 toolsIdentity — BEATS
Behavioral authentication triage suite for sign-in anomalies, token misuse, and account review.
Endpoint — CrowdStrike Scripts & Queries
Curated RTR scripts and advanced event search queries for rapid endpoint investigation.
Endpoint — KAPE
Forensic artifact collection with curated targets and modules for fast host evidence capture.
Endpoint — D2FAP
Disk and data forensic analysis pipeline for automated evidence processing and enrichment.
Endpoint — Process Grapher
Visualize process execution lineage and parent-child relationships from endpoint telemetry.