Many agents.
One seam.
AI agents hunt, investigate, engineer detections, and prepare response across the whole platform. They share the same evidence, memory, and operating rules. Your people keep control of every decision that matters.
One conversation. The whole bench.
The Assistant is the layer above the fleet: the chat you talk to, and the orchestrator that decides which specialists run. It plots and ranks over the lake, writes up what it found, and proposes the follow-ups. Ask it for rules, investigation canvases, seeded entities or reports: you hold one conversation, and it runs the bench.
Three exchanges on a loop: it ranks over the lake, drafts a rule and holds it for review, and builds a canvas while seeding entities. Each time the Assistant decides which of the bench below to run, and how many.
They share one brain.
Memory, doctrine and harness turn a fleet of agents into a team that learns your environment, follows your process, and stays inside the boundaries you set.
- memory
- What the agents have already learned about your estate, carried from one run to the next.
- doctrine
- Your rules of engagement, written down and enforced, so every agent works a case the same way.
- harness
- The tools each agent may reach for, and the limits on how far it may go without you.
Every job in the SOC. Covered.
Analyst agents investigate cases. Operations agents maintain detections and response. Platform agents keep data, integrations, and reporting ready. All work from the same evidence and rules, with your people making every decision that matters.
analysts
operations
platform
The queue is empty by morning.
Every alert reviewed with a full evidence trail, escalated only when a human is genuinely needed.
Any frontier model. Or your own.
Choose the model that fits the work and your data policy. Use a leading model where it belongs or run your own when sensitive work must stay inside your environment. The agents keep the same memory, doctrine, and controls.
- frontier
- The leading models, supported as the frontier moves. Swap without rewiring anything.
- your own
- Privately hosted models run the same harness on your infrastructure.
- effort and cost
- You choose effort and capability, per agent. The cost is clear before the run, and itemized after.