Avispa OrbitSOC

One alert, start to finish.

A team of agents works each case. A person decides.

How a case moves

  1. 1Context first

    Hosts, users, reputation and history are looked up before any AI runs.

    Asset discoveryEnrichment
  2. 2Triage

    The triage analyst sets severity and picks the depth: quick, standard or deep.

    Triage analyst
  3. 3Specialists

    The planner dispatches specialists in parallel, round by round.

    PlannerExecutorEndpointIdentityNetwork
  4. 4Correlation

    Related alerts are linked into one case.

    Correlator
  5. 5Red team

    The red team attacks the conclusion, looking for blind spots.

    Red team
  6. 6Checkpoint

    The SOC manager approves, sends it back once, or flags it for escalation.

    Response advisorSOC manager
  7. 7Report

    Written once, after every check, and held to its own evidence.

    Reporter
  8. 8A person decides

    Your analyst confirms or overrides. Only a person declares an incident.

    Your analyst

Tier 1 Triage and enrichment

  • Asset discovery
  • Enrichment
  • OSINT analyst
  • Triage analyst
  • OSINT collector
  • Health monitor
  • Coverage analyst

Tier 2 Deep investigation

  • Planner
  • Executor
  • Correlator
  • Endpoint
  • Identity
  • Network
  • Cloud
  • Email
  • Malware
  • Insider threat

Tier 3 Analysis and oversight

  • Red team
  • Reporter
  • SOC manager
  • Hunt planner
  • Hunt executor
  • Detection engineer

Tier 4 Incident response

  • Response advisor
  • Playbook executor
  • IR monitor
  • Lessons learned

Your analyst

The case file

  1. Recommended outcome, with confidence
  2. Executive summary
  3. Timeline
  4. Evidence artifacts
  5. Technical narrative
  6. Alternate hypotheses
  7. Response steps, mapped to playbooks
  8. Report export
More: replay an attack, and the watch after the verdict

Replay any attack.

Storyline replay

Initial access

  1. Link in a phishing email opened on FIN-WS-22

Execution

  1. PowerShell runs an encoded command
  2. Archive tool runs on APP-SRV-07

Persistence

  1. Scheduled task created to run at sign-in

Credential access

  1. A process reads LSASS memory

Lateral movement

  1. Remote desktop to APP-SRV-07 as a.rivera

Exfiltration

  1. 1.2 GB sent to cdn-update.example

Response

  1. Recommended: contain FIN-WS-22 and APP-SRV-07
  • FIN-WS-22
  • APP-SRV-07
  • a.rivera
  • 203.0.113.24
  • cdn-update.example
  • powershell.exe
  • rundll32.exe
  • 7z.exe
09:55

Step through or play end to end, at 0.25× to 4×, for handoffs and reviews.

See a live investigation

The watch keeps going after the verdict.

After escalation, agents keep re-checking the hosts, accounts and IPs involved. Every 15 minutes, then hourly, every 4 hours and every 12 hours, for up to 7 days.

Bring an alert you know to the demo.

Book a demoSee a live investigation