Platform / Capabilities
The capability index
Everything the platform does, with how it's charged and how settled it is.
Eighty-eight capabilities, grouped by the layer they belong to. Nothing here is gated behind a form. Read it, and decide whether this is serious before you talk to anyone.
How to read the charging column
It names the mechanism, not an amount. On the platform line there is exactly one: raw volume ingested per day. Everything else reads included, which means there is no mechanism by which it could bill — not that it is a lesser capability.
Why there are no prices here
Two lines are generally available and sold — the platform, and verification. Six more are built but not yet sellable, so quoting a number against them would be quoting something you cannot buy. Prices go up when a line does.
What preview means
That the shape of its interface may still change. It is not a trial and not a lesser tier — a preview capability is licensed and supported like any other.
FILTER
Showing 36 of 88. The rest are variations within these families, and the full list ships with the product.
Layer 1
Everything that happened
The agent
One program doing the work several products used to install separately — collection, enforcement and local policy.
included
machine
Integrations
Anything that emits a signal becomes the same kind of event. Every source is listed in the integration catalogue.
included
tenant
Event store and search
Sealed, timestamped events with a query surface over them. Bounded scans say when they stopped.
by volume
tenant
Retention and legal hold
How long events are kept, and how a hold overrides that for a named investigation.
by volume
tenant
Continuous export
A stream of canonical events to a collector you nominate. Bounded by a policy you can read.
included
tenant
Source health and gaps
Which sources are reporting, which stopped, and which never started — three different states.
included
tenant
Composed report delivery
Scheduled reports to named recipients, bounded by an egress policy you can inspect.
included
tenant
Encrypted DNS resolver
preview
A resolver that answers over encrypted transports and blocks known-bad names at the point of asking.
included
platform
Layer 2
Making sense of it
Detection library
Rules with their logic, their technique mapping and their tests published rather than hidden.
included
tenant
Behavioural baselines
What normal looks like for one machine or person, learned from their own history rather than a global average.
included
tenant
The provenance graph
Events joined by what caused what, so a moment arrives with its lead-up and aftermath attached.
included
tenant
Hunting and free query
Ask in plain language or write the query yourself; either way the compiled plan is shown back to you.
included
tenant
Detection authoring and tuning
Write, version and tune detection content without editing the platform.
included
tenant
Coverage against known technique
What you can and cannot currently detect, counted honestly — including what nothing measures.
included
tenant
Entity registry and aliases
preview
One identifier, every other name the same thing is known by, and who held an address at a given moment.
included
tenant
Vulnerability reachability
Findings ranked by whether anything can actually reach them, which is what makes a queue defensible.
included
tenant
Memory and disk forensics
preview
Deeper collection from one machine when an investigation needs more than the event stream.
included
tenant
Detonation sandbox
preview
Run a suspicious file somewhere it cannot matter, and keep what it did as evidence.
included
tenant
Layer 3
Doing something
The approval gate
The single place every world-changing action passes, and the single place to ask why one happened.
included
tenant
Containment and isolation
Cutting a machine off while keeping your own access to it. Reversible, and held by default on important tiers.
included
tenant
Playbooks and automation
Sequences of actions that still each cross the gate individually. There is no path that skips it.
included
tenant
Case management
Run an incident with its evidence attached, and export it for someone who has no access here.
included
tenant
Canary, verify and rollback
One machine first, then a check, then the rest — and an automatic rollback when the check fails.
included
tenant
Recovery orchestration
preview
Getting back to a known state after an incident, in an order somebody decided in advance.
included
tenant
Emergency stop
Halts the whole automation plane rather than one action. Sits beside the queue, because that is where you will be.
included
tenant
Virtual patching
preview
Blocking the path to a vulnerability at the edge while the real fix is scheduled.
included
tenant
Deception and honeytokens
preview
Things that have no reason to be touched, so touching them is a signal with almost no false positives.
included
tenant
Layer 4
Who, and may they
Authentication and step-up
Proving who you are, and proving it again at the moment of a consequential act.
included
tenant
Enterprise sign-on and provisioning
Reads from the directory you already have rather than asking you to migrate to ours.
included
tenant
Privileged access and sessions
Elevated access that is requested, approved by a second person, time-bounded and recorded.
included
tenant
Non-human identity inventory
The service accounts and keys nobody remembers creating, and what each of them can still reach.
included
tenant
Policy declaration and assurance
preview
Say what the estate should be, then see per machine whether it is — including where nothing could judge.
included
tenant
Compartments and need-to-know
preview
Material only named holders may read, with a request path a second person approves.
included
tenant
Reports and evidence export
Narrative reports where every claim carries a link to the record that proves it.
included
tenant
Data classification and protection
What counts as personal or sensitive in your estate, and what may leave which machine.
included
tenant
Consumer rights desk
preview
Handling a person’s request about their own data, with the erasure actually reaching everywhere it exists.
included
tenant
What this page is not
It is a list of what exists, not a list of what you hold. Which of these are switched on for a given organisation depends on its licence, and the console answers that question for the organisation you are signed into. A capability absent from your console is absent rather than locked — there is no upsell shelf in the product.