A pile of alerts is not an investigation.
Cases group related evidence, takedowns and analyst work into a single workstream, so a campaign that arrived as eleven separate notifications can be worked as one thing.
What lives inside a case.
Evidence
Every marble attached to the case, with its sources, its confidence, and when each source last confirmed it.
Findings
A direct channel to our analysts for work that goes beyond automated detection: attribution, infrastructure mapping, evidence preservation.
Takedowns
Request removal, track the request through to resolution, and keep the evidence package attached to the case that produced it.
Notes and history
Who changed what, when, and why. An investigation nobody can reconstruct later was not an investigation.
Every case moves through the same states.
A fixed lifecycle is what makes two analysts hand work to each other without a meeting.
-
Open
Something needs a person
Evidence has converged enough to be worth attention, or an analyst opened the case deliberately.
-
Triage
Decide what this is
Confirm attribution, set severity, and pull in the related marbles that arrived separately.
-
Act
Do the thing
Rotate the credential, claim the subdomain, request the takedown, notify the person whose identity is exposed.
-
Resolve
Write down what happened
Close with a reason. The reason is what makes the next similar case faster.
Success is not the number of alerts we send.
It is how quickly an analyst can answer four questions: what happened, who is involved, why it matters, and what should happen next.
More evidence. Less guessing.
We don't promise perfect visibility. We promise better understanding.