Everything between the alert and the answer
A SOC platform earns its place in the minutes it removes from every case. These are the parts of SOCPilots that do that work, and what each of them is actually responsible for.
From signal to judgement
Five things happen to every alert before a person is asked to think about it. This part is a genuine sequence, so it runs in order.
Arrive
Alerts are pulled from your SIEM on its own terms — an index, an API, a saved search — and normalised into one internal shape so everything downstream works the same way regardless of backend.
Deduplicate
Repeat signal collapses into one case rather than forty tickets. The same host hitting the same rule for an hour is one piece of work, and the case shows how many times it fired.
Enrich
Indicators are looked up against intelligence feeds and cached, the asset inventory supplies criticality and ownership, and the behaviour graph supplies what the entity normally does.
Score
Severity from the rule is weighed against what the enrichment found and how important the asset is. A medium rule on a tier-0 host is not a medium case.
Dispose or escalate
Where the evidence is unambiguous the case is closed with its reasoning recorded. Where it is not, it lands in the queue already carrying everything an analyst would have spent the first hour collecting.
Cases that hold the whole story
Investigation is a record, not a chat log. Everything that happened to a case stays attached to it.
Cases
casesA case holds the alerts, the evidence, the timeline, the tasks and the verdict in one record. Closing one requires a disposition and a closure note, so a case that is shut is a case that was answered.
Tasks and ownership
tasksWork inside a case is assignable and trackable. Where workforce management is enabled, new cases route to whoever is actually on shift and under capacity rather than to whoever is unlucky.
Evidence
evidenceUpload the artefacts an investigation produces — documents, spreadsheets, exports, screenshots. Text is extracted, including from images, and indexed so later investigations can find it.
Collaboration
commentsMention a colleague by name in a case, a task or a war room and they are notified. Mentions resolve against real accounts, so a typo does not silently notify nobody.
Service levels
slaResponse and resolution clocks run against the policy you set, pause outside business hours where that is what you promised, and warn before a breach rather than after it.
Behaviour as a graph, not a number
A risk score tells you something is wrong. A graph tells you what. SOCPilots models users, hosts, processes, files and network destinations as entities with relationships between them, and scores anomalies against that structure.
Seven anomaly classes are weighted and combined: impossible travel, lateral movement, privilege escalation, first access to a host, a process never seen before, out-of-hours activity and login frequency spikes. Machine-learning scoring runs alongside the rules rather than replacing them.
The rest of the console
ATT&CK coverage
Fourteen tactics and roughly 190 techniques, coloured by how much detection you actually have. Drill into a technique for the rules, agents and recent alerts behind it, then export to MITRE Navigator to compare against a roadmap.
Threat intelligence
Indicators are enriched against reputation and pulse feeds, cached so the same address is not looked up forty times an hour, and cross-referenced against a stored indicator feed that raises the score on anything already known bad.
Assets and exposure
Discover what is on the network, track criticality and ownership, and find the hosts your SIEM has no agent on — the blind spots that make coverage numbers look better than they are.
Vulnerabilities
Exposure per asset, tied back to the same inventory the cases use, so a vulnerability on a tier-0 host reads differently from the same vulnerability on a lab machine.
Reporting
Operational reporting for the people running the shift, and executive reporting for the people funding it. Volumes, response times, coverage, and what changed since last month.
Digital risk
Monitoring beyond the perimeter — credential leaks, brand abuse and dark-web mentions — brought into the same case system as everything else.
One console, five points of view
Role decides what a person sees and what they are allowed to do. It is a permission model, not five different products.
Analyst
l1 · l2Works the queue: triage, enrich, document, respond. Sees their own tenant and their own assignments first.
Senior analyst
l3Owns escalations, approves containment requested by others, and authors detection content.
SOC manager
reportingWatches queue health, response times, shift coverage and service levels, and reassigns work when a queue tips over.
Administrator
adminConfigures connections, users, policies, automation and workspaces. Every change is written to the audit trail.
Executive and client
read onlyPosture, risk and outcomes without the operational detail — and, for a managed customer, a view scoped strictly to their own organisation.
See it against your own backend
A demo on your SIEM tells you more than a demo on ours.