Per-host history
Each protected system keeps its own record. Nothing is merged destructively; the graph reads the histories and points back to them.
Intelligence fusion
Correlate the observations. Preserve the evidence. Test the hypothesis.
Independent per-host histories, joined by a local intelligence graph inside the customer's own domain. Every link carries its grade, its provenance and the explanations that would make it innocent.
Evidence grades
Confirmed, supported hypothesis, unverified. A grade rises only with new evidence, and an analyst confirms before anything becomes a conclusion.
Alternatives on the record
Shared corporate gateways, public Wi-Fi, identical standard-issue devices, coincidence. Each link names what else could explain it.
Interactive
Interactive demonstrationSynthetic investigation
A worked case on fictional data: follow the evidence, weigh the links and choose the response.
Case NORTHWIND-07 · synthetic exercise
confirmed directly evidenced supported consistent evidence, not proof unverified possible, weak
Select a node in the graph.
Chronology
- Day 1, 19:02
198.51.100.23 reads team and careers pages on three properties. - Day 4, 19:10
198.51.100.23 returns; same pages, same order. - Day 6, 10:31
203.0.113.140 enumerates the staff directory, one profile per 40–60 s. - Day 8, 19:24
2001:db8::4f arrives from a shared document and reads the careers page. - Day 9, 19:05
198.51.100.23 returns a third time.
Choose a constrained response
The simulated effect appears here.
SOVEREIGN BY DESIGN.
See it on your own environment
A briefing walks through how the platform reconstructs, links and reports activity — on synthetic data, never on another organisation's.