Everything your SOC actually needs.
Alerts in, investigation in the middle, a closed incident and a regulator notified on the way out. Every feature below ships in the build you can download today.
Ingest. Deduplicate. Triage.
One endpoint, and the sender does not have to learn our schema.
Machine ingestion
POST /api/v1/ingest/alert takes an alert from a SIEM, an EDR or a script. Batches of up to 200, 1 000 alerts per minute per organisation.
Field mapping, not integration work
Splunk's search_name, Elastic's rule.name, Sentinel's AlertName all land in the right column. Severity words, P1-P5 and risk scores are understood.
Deduplication you control
Send a dedup_key and a redelivery returns the alert that already exists instead of creating a second one. No key, no merging: losing an alert is the worse failure.
Observable extraction
Send strings and ir classifies them, or declare the type yourself. Fourteen types recognised, up to 100 per alert, nothing silently dropped.
Triage queue
Filter by severity, source, age and status. Triage decisions are explicit: true positive, false positive, benign, escalate. False positive rate is tracked for you.
Escalation
Promote an alert to a case, or attach it to one that already exists. Observables, severity and source travel with it.
Two levels, because a breach is not a ticket
A case is one investigation. An incident is the thing your organisation has to answer for, and it carries its own lifecycle, commander and clock.
Cases and tasks
Severity, status, TLP, assignee. Case templates seed a predefined task set so a phishing investigation starts with the same eight steps every time.
Incidents, NIST lifecycle
Identification, containment, eradication, recovery, lessons learned. Incident commander, responder team, impact assessment, estimated against actual cost.
Activity timeline
Every status change, comment, attachment and observable, timestamped and append-only in ClickHouse. Two-year default retention, configurable from 30 to 3 650 days.
Evidence with chain of custody
SHA-256 and MD5 computed at upload, up to 50 MB per file, PCAPs and archives included. Files live on your volume, never on a third-party service.
Merging and moving
Merge a duplicate case and every child record moves with it. The merged case stays reachable, faded and struck through, so a stale link still tells you where the work went.
SLA that actually fires
Deadlines written at creation, recomputed when severity changes, always from the record's creation time. Remaining time on the page, a badge in lists, an overrun in the report.
One indicator, nine opinions, one verdict
Nine sources, asked at once
mlab.sh, VirusTotal, AbuseIPDB, GreyNoise, urlscan.io, AlienVault OTX, Shodan, MISP and Have I Been Pwned. Answers merge into one verdict with every source still readable underneath.
Routing by observable type
A grid decides who answers for addresses, domains, hashes and the rest. Enabled and automatic are separate switches, because a key with 500 daily requests is worth having for one and ruinous for the other.
Sources you declare yourself
Any REST API returning JSON: a URL template, an auth header, the types it covers, JSON paths for the verdict and each fact. No code, no rebuild.
Six-hour cache
Per organisation, keyed on a hash of the lookup. Refresh bypasses and clears it. Failures are never cached, so a corrected key works immediately.
Cross-case correlation
The same indicator seen across other alerts and cases, surfaced on the observable itself. Institutional memory instead of a colleague's recollection.
CVE enrichment
CVE observables resolve against vuln.mlab.sh and are cached in ClickHouse. Incidents carry validated CVE references.
The SOAR half, without the SOAR invoice
Visual playbooks
A DAG editor with HTTP request, condition, transform, delay, add observable, change status, assign case, notify and log nodes. Template variables carry values between nodes.
Triggers and history
Manual, alert, incident, case or webhook. Every run records per-node input and output, with a ten-minute execution ceiling.
Outbound webhooks
Slack, Discord, Microsoft Teams or your own endpoint, each rendered in that platform's payload shape. Three attempts with backoff, and a delivery log for every one.
Conditions on subscriptions
Minimum severity, a text match on title or detail, and an option to ignore anything automation caused. ANDed together, so a channel gets what it asked for.
REST API v1
Full CRUD on every entity, an OpenAPI specification, and a case report as PDF at /api/v1/cases/report/<uuid>?format=pdf for a ticketing system or a nightly job.
Exports
Alerts, cases, incidents and the activity log as CSV, JSON, JSONL or Markdown. Incident exports carry classification, cost and RGPD fields.
The work that happens between incidents
Post-incident reviews
Hot reviews on a five-day clock, cold reviews on 180 days. Each NIST phase scored 1 to 10, what worked, what failed, and anonymous feedback per review.
Action items that close
Category, priority, assignee, due date, and a link to the change request that implemented them. A review that produces nothing is visible as such.
Risk register
Likelihood and impact on a 1-5 scale, auto-calculated level, owner, treatment plan, and a link from a risk to the incident that proved it real.
Response plans
Versioned documents with a review interval, a next-review date and an overdue indicator. Marking one reviewed increments the version.
Knowledge base
Wiki articles with categories, tags, draft and published states, and pinning. Runbooks that live next to the incidents that need them.
Emergency contacts
Internal and external, with role, phone, email and organisation. The list you need at 3am is inside the tool, not in someone's phone.
Built for the people who run it
Permissions, twelve bits wide
Admin, Team, Cases, Incidents, Alerts, Playbooks, Observables, Timeline, Analytics, Settings, Compliance. Granted per member, checked on every route.
TLP enforcement
Optional per organisation. TLP RED restricts a record to the commander, its responders and admins. TLP AMBER to holders of incident permissions.
Two-factor authentication
TOTP and WebAuthn passkeys, with recovery codes offered only alongside a real factor. REQUIRE_2FA forces enrolment for the whole workspace.
Scoped API keys
An account key is nominative and judged by the same checks as its owner. An app token may create alerts and nothing else. Prefixes make a leaked key identifiable.
Dashboards
MTTD and MTTR trends, false positive and escalation rates, an alert heatmap by hour and weekday, a triage funnel, SLA compliance and top responders. Custom widgets, no Grafana required.
Backups & migrations
Volume-mounted data, one-command dump, and SQL migrations applied automatically at boot. Pull the new image and restart.
What we do not do yet
Stated here rather than discovered during an evaluation.
No STIX or TAXII export
Observables leave as CSV, JSON, JSONL or Markdown, or through the API. MISP is supported as an enrichment source, not as an export target.
No enterprise single sign-on
No OIDC or SAML yet. Authentication is password plus a second factor, with sessions capped at three per user.
Provider keys are not encrypted at rest
A database backup contains them. The same is true of API keys, stored in the clear so the settings page can show a preview.
No shift-aware auto-assignment
Escalation rules route by severity, category and attack vector. There is no rota, no round-robin and no out-of-office awareness.
Want to see how the stages connect?
The workflow page walks through the alert-to-closure lifecycle in detail.