Sentinel SOC

Overview

A SOC analyst workspace that correlates endpoint, cloud, and network telemetry into a single triage queue.

Challenge

Analysts were drowning in alerts from 9 disparate tools — average mean-time-to-detect was over 8 hours.

Solution

We built a streaming correlation engine on Elastic, with a React workbench for investigation and playbook automation.

Outcomes