Beyond the single pane of glass.

One incident in. Coverage for every tenant out.

A SOC that learns from every attack, and closes the gap for every tenant.

Attackers change their playbook all the time, so the gaps move with them. Every campaign we have handled, from Storm-2755 to Storm-2372, went through the same six steps: it starts with one real incident, is checked against every tenant’s own history, and ends with tested detections running across the fleet. AI agents do the collection, research, testing and fleet-wide hunting. People make the calls that matter: what is malicious, what ships, and what touches a customer.

Stages

6

Human decision points

3

Threat report to tested rule

< 3 hours

AiTM case now forms

21 hours sooner

1. 01

   Start with one incident

   An analyst’s case, a customer escalation or a threat report someone hands over, never a brainstormed list of what might go wrong. A real incident comes with real logs, and real logs make the later stages provable.

   • Person: picks the case and says what it is: confirmed, suspected, or a report to check against.
   • AI: opens a working file, pins the time window, users and tenant, and lists the evidence it needs.

   From case A: Why did existing rules raise nothing until the mailbox was already being read?

2. 02

   Collect ground truth

   An agent pulls every sign-in, directory audit, mailbox and file record that touches the case and rebuilds the attack minute by minute: a timeline that shows which record proves which step, not a summary.

   • AI: queries the lake and joins records on session and correlation IDs.
   • AI: writes a sanitized sample set later stages can replay safely. Customer records never leave the platform.

   From case A: The proxy’s own sign-in carried error 90014 after MFA had already succeeded: the earliest reliable signal.

3. 03

   Look for intelligence

   The ground truth is set against public reporting and our own past cases. This turns one victim’s story into the attacker’s playbook, so the detection covers the next victim as well as this one.

   • AI: reads vendor reporting, maps each step to the log record that would show it, and flags indicators that will not hold.

   From case C: The reported app ID is random since 2024, so the rule keys on behavior: create, grant, secret, act.

4. 04

   Test detections

   Rules are written as code and run on the real runtime. The incident must fire them, made-up variants must fire them, and normal admin work must not. Mirror sites first, then one real tenant for a day, then the fleet.

   • AI: writes the rules, builds the test sets, runs them, and reports what fired and what did not.
   • Person: reviews the results and approves the release. Nothing reaches tenants until a person pushes it.

   From case C, same afternoon: 245 real log lines replayed: identical to the old processor.

5. 05

   Hunt the fleet

   Once a pattern is understood, an agent hunts for it in every tenant’s history, not only the tenant where it was found. This finds the victims nobody has reported yet, and shows how noisy the rule will be before it ships.

   • AI: runs the hunt across every tenant in parallel, then follows every lead to a verdict: benign or escalated.

   From case C: 30 days, every tenant, no errors. Two lookalike apps were admins’ own tooling, which set the new rule’s levels.

6. 06

   Find rule gaps

   Every step of the attack is matched against the rules we already run: covered, covered only on some data sources, or a gap. A fleet survey also finds tenants where an existing rule is switched off or tuned away.

   • AI: builds the coverage matrix and proposes a rule for each gap, ranked by what the hunt showed.
   • Person: chooses which gaps to close now. Every rule change on a customer tenant is their decision.

   From case C: Three gaps closed the same day; two logged as open and next in line.

Each gap that stays open becomes the starting question for the next incident.