Product
Cases, alerts, tasks, and the incident record in one workspace
At triage, the analyst sees the alert, its observables, related alerts, and the case it belongs to, without typing the same facts again. Tasks, evidence, the timeline, and the write-up stay on that case. The installation is yours: you deploy it, you back it up, and you decide which tools it may call.
Cases
Build the case once
A case carries its severity, status, TLP and PAP, owner, and assignees, with tabs for the work: tasks, observables, TTPs, evidence, related cases, the timeline, and documentation.
- Statuses you define, not a fixed list
- TLP-aware access on the record
- Related cases and alerts linked, not copied
Alerts and observables
Triage with the context already attached
Observables such as IPs, domains, URLs, and hashes are listed on the alert and the case. Enrichment runs through the providers you connect, and techniques are mapped to MITRE ATT&CK. Each provider is called from your installation, so it needs a network path to that service.
- Enrichment from Cortex, IntelOwl, VirusTotal, Recorded Future, or Intezer
- Similar alerts surfaced beside the one you are reading
- Open a case from an alert without retyping it
Coordination
Tasks, owners, and approvals on the case
Split the response into tasks with owners and due dates. Role-based access decides who can see and change what, and cross-team grants let another team work one case without opening the rest.
Real-time co-editing of case documentation uses Liveblocks, a service outside your installation. An isolated network should plan for it separately.
- Task groups for waiting, in progress, and completed work
- Roles scoped to an organization or a team
- Case grants to one user or one team
The record
What happened, kept with the case
Evidence, the timeline, and the incident documentation stay on the case, in the database and object storage of your installation. The record for the review afterward is written where the work happened, not reassembled from chat.
- Root cause and corrective action, post-incident review, and after-action report
- Lessons learned attached to the case
- Audit history and legal hold for the record
Documentation
A draft in the case, not a change to it
Select a passage in the case documentation and ask the writing assistant for an incident summary, an executive update, or a redaction. The draft opens next to the text, and the case changes only when you accept it.
The assistant uses a model you run or contract, set in the AI settings. Without one, the documentation works as it always does.
- Improve writing, fix mistakes, simplify, or summarise
- Security drafts: incident summary, executive update, redaction
- Accept or discard the draft; the passage stays until you do
See a case from first alert to approved response
A demo is a live walkthrough of one case on a call. Or install Community on your own host: every feature, one user, no expiry.