One case format
From a subdomain takeover to an underground listing, every finding becomes a #TK-numbered case carrying tags such as Takeover, Phishing, Brand Abuse or Patch Required.
OPS Command screen, cases, playbooks and investigation tools
Operations Center
Every module's findings land in a single case format. The team prioritises from the command screen, owns each case and automates repeat work with playbooks.
Screenshots are taken from a demo tenant; organisation names and data are entirely fictional.
A CTI platform is worth what happens after a finding — who gets it and how it closes — not how many findings it produces. The Operations Center turns every source, from the attack surface to the dark web, into the same case: an ID, a severity, a category, an owner, a description and a remediation. The command screen is the shift's first look; the Entity Graph and Global Discovery are the investigation tools, and the SOC Armory is for quick verification.
What it does
Playbook automation
Trigger, condition, action: "open a critical case when a CVSS 9.0+ vulnerability matches" or "start a takedown request on a new look-alike domain".
Investigation tools
The Entity Graph maps relationships, Global Discovery searches every module, and the SOC Armory puts quick checks — WHOIS to hash reputation — on one screen.
How it works
-
01
A finding arrives
An attack surface scan, a dark web match or a new leak record leaves its module and enters the command flow.
-
02
It becomes a case
If a playbook condition matches, the case opens automatically; otherwise an analyst opens it at triage. Severity and category are set here.
-
03
It is owned and closed
An owner is assigned and the remediation applied. The case closes as resolved, risk accepted or false positive — with its reason recorded.
Sub-modules
CMD
Tactical Command Center
Open cases by severity, exposure over the last 30 days, the ransomware pulse for your sector. Every figure clicks through …
The shift's first screen
CASE
Cases
Every finding is a case with a number, severity, category, owner, description and a step-by-step remediation. Comments, attachments and a …
Findings with an owner an…
PLAYBOOK
Case Manager
Automate case creation and escalation with playbooks. Start from the catalogue, tune conditions to your thresholds, and see every run …
Trigger, condition, action
GRAPH
Entity Graph
Connect domains, people, emails, passwords, technologies, CVEs and actors on a single canvas. Save the map, share it with the …
Investigate by seeing the…
SEARCH
Global Discovery
News, rules, IoCs, dark web posts, actors, CVEs, cases and reports: search them all with one query and narrow the …
One search across every m…
ARMORY
SOC Armory
Blacklist, reverse DNS, WHOIS, DNS lookup, subdomains, SSL certificate, HTTP fingerprint and hash reputation on one screen. Paste a target; …
Quick checks for IPs, dom…
What you get
- Shift handover happens on one screen, open cases sorted by severity.
- Every closed case keeps its reason; the same finding is not asked twice.
- Repetitive triage moves to playbooks, freeing analyst time.
Next step
What shows up on your own surface?
In a 30-minute session we run a live scan against your own domains.