Plain words
Each verdict is a short explanation any analyst or executive can read without writing a query.
iNTelligence
Every alert triaged, and every verdict explained in plain words.
Detection, triage and Sovereign AI reasoning work through your events so your analysts start on the cases that matter, with the why already written.
From a clean event to an explained verdict.
Events arrive already collected on your site and cleaned of personal data. iNTelligence takes it from there.
No black boxes. Every verdict shows its working.
Mapped technique
Every verdict names the ATT&CK technique and tactic, so analysts can pivot straight to it.
Kept and exportable
The chain from event to reasoning is kept, and can be exported for audit and forensic work.
Chat with your data
Ask the console a question in plain words and get an answer drawn from your own events.
What an explained verdict looks like.
The reasoning arrives with the alert. Your analyst reads what happened, why it matters and what to check next.
- Severity and ATT&CK technique on every verdict
- Written for the person on shift, not for a query language
- Linked to the case that holds the evidence
HighT1110 Brute forceCredential access
Repeated failed sign-ins followed by one success on a VPN account.The same outside source tried many passwords against one account, then signed in. The success came from a country this account has not used before. Treat the account as compromised until the owner confirms.
Illustration, sample verdictWhere the AI runs, and what it sees.
Personal data is removed before any hosted model sees an event. Sovereign Edition keeps all reasoning inside your own deployment.
| Step | Hybrid Sovereign | Sovereign Edition |
|---|---|---|
| First verdict | Sovereign AI | Sovereign AI, inside your deployment |
| Deeper analysis | Hosted model, on scrubbed summaries only | Sovereign AI, inside your deployment |
| Raw logs | Stay in your network | Stay in your network |
| Personal data sent to a hosted model | None | No hosted model used |
The case is written before your analyst opens it.
Hosts involved, destinations reached and a timeline of what happened next, gathered in one place.
See Mission ControlSee your own alerts explained.
60-day full-platform trial. No credit card. No inbound firewall changes. Live in under an hour.