First case brief
Preview target for assembling an initial timeline, affected entities, evidence links, and open questions after ingestion.
Private preview
SOC context automation
Reduce repetitive triage work without obscuring the evidence.
Poxek AI SOC groups related alerts into cases, builds an entity and activity timeline, and runs bounded investigation steps across connected security tools. Every generated conclusion links back to source events or query results; response actions remain approval-gated unless an operator explicitly changes the policy.
Poxek AI SOCContext graph / live
Private-preview benchmark
Targets for the private preview.
These figures are private-preview evaluation targets—not measured customer results, guarantees, or contractual SLAs.
Evidence-linked conclusions
Every factual assertion in a generated case summary should resolve to source telemetry or a recorded tool result.
Autonomous containment
The private-preview workflow performs no high-impact response action without explicit human approval by default.
Poxek AI SOC
Capabilities
Evidence-grounded case assembly, investigation playbooks, and human-supervised response for teams handling fragmented alert context.
Threat-centric case assembly
Cluster related alerts, identities, endpoints, cloud resources, and network indicators into one case with a deduplicated timeline and explicit correlation reasons.
Evidence-grounded investigation
Run approved searches and enrichments, cite every source record, expose missing telemetry, and separate observed facts from model-generated hypotheses.
Approval-gated response
Draft containment steps, tickets, stakeholder updates, and detection changes while requiring an analyst to approve high-impact actions and preserving the full audit trail.
Operating flow
Evidence moves with the decision.
Receive an event or incident
Collect relevant operational context
Run bounded enrichment workflows
Escalate an explainable case
Operational use cases
Where the workflow should earn its place.
Group identity and endpoint alerts
Connect sign-in anomalies, privilege changes, endpoint detections, and network activity into one timeline instead of assigning each alert independently.
Prepare a senior analyst handoff
Package confirmed observations, competing hypotheses, completed queries, missing evidence, and recommended next steps without hiding the raw records.
Document and improve the response
Generate a reviewable case log, capture analyst corrections, and turn validated gaps into detection or playbook work rather than silently retraining behavior.
Outcome
A shorter path from fragmented alerts to a defensible analyst decision, with source evidence, uncertainty, approvals, and operator corrections preserved.
Private preview
Bring the perimeter and the response into the same conversation.
Tell us which operating constraint you need to examine. Private Preview discussions begin with scope, governance, and evaluation context.