Start with onboarding
A repeatable investigation path
Pilot gathers context and builds a plan through the same named phases.
MSSP/MDR · Deliver the service
Investigate with an action plan in hand.
Keep approval with your team.
Virtus Pilot investigates customer cases through eight phases and hands your analyst findings, an action plan and an investigation report. Gated actions wait in the Approval Center, and Automatio turns your response procedure into a repeatable playbook where licensed.
Eight investigation phasesGated actions in the Approval CenterExportable investigation report
AgentsNorthstar
Virtus Pilot
- Case
- NS-104
- Title
- Privileged account activity
- Tenant
- Northstar
- Operating Mode
- Guided
- Launch
- Configured escalation
A configured Triage escalation starts this investigation.
Investigation Mode
GuidedPlanned actions need approval
Auto-Approve Risk LevelMedium, illustrative configuration
Always Require ApprovalIsolate, block, terminate, delete, quarantine
CasebookThe case stays open
AgentsNorthstar
Virtus Pilot
IntakeEnrichRAG + KAG RetrieveAnalyzePlanExecuteEvaluateReport
- Case
- NS-104
Execute sends gated actions for approval. A pending action does not mean the report must pause.
Investigation Plan & Hypothesis
NS-104Privileged account activity
HypothesisSuspicious activity may involve WS-0412
Pending actionIsolate host WS-0412
GuidedA person decides on planned actions
Approval CenterNorthstar
Virtus Pilot
Isolate host WS-0412NS-104 / Guided
Pending approvalHypothesisSuspicious account activity on the host
Risk assessmentIsolation changes the host’s connectivity
Approve AllReject
Investigation Plan & Hypothesis
- Case
- NS-104
- Mode
- Guided
- Action
- Isolate host WS-0412
- Decision
- Awaiting an authorized analyst
Approval and rejection need permission and are recorded in the audit log.
AgentsNorthstar
IR ReportExport PDF
NS-104Privileged account activity
FindingsAccount activity reviewed
Isolate host WS-0412Approved by 
A. Rivera
ExecutedA. RiveraCasebook
- Case
- NS-104
- Customer
- Northstar
- Owner
- A. Rivera
- Phase
- Investigation
Pilot does not close the case. Inspect the action outcomes as well as the report.
By default, isolate, block, terminate, delete and quarantine require approval. Risk and approval settings are configurable.
A configured escalation launches Pilot for Northstar. This example uses Guided mode.
Intake through Report uses the product’s eight phases. Guided mode sends planned actions for approval.
An authorized analyst reviews the pending isolation and its hypothesis in the Approval Center.
The IR Report and recorded action outcomes show what happened. Pilot does not close the case.
Illustrative customer workflow
01 - What it does
Repeat the investigation. Keep the decision.
Investigation work can begin from a configured Triage escalation, a case rule or a playbook. Your team sets how far Pilot may act and reviews the findings before deciding on gated actions.
Choose the mode for the procedure.
Autonomous mode runs actions within the configured risk line and approval list. Guided mode sends planned actions for approval; audit mode skips execution. The setting belongs to the rule or playbook step that starts the investigation, so your procedures can apply different controls. The resulting report gives the analyst findings to inspect, with executed, pending and failed actions distinguishable in the result.
Each routed case follows the same investigation path, and your team keeps the execution controls.
Northstar: NS-104Example
- Operating Mode
- Guided
- Auto-Approve Risk Level
- Medium
- Pending action
- Isolate host WS-0412
- Case
- Remains open
Illustrative setup and values, not customer results.
A place to decide
Review gated actions in the Approval Center before they execute.
02 - How it works in the product
Start from the case. Decide on the action.
Use the investigation result to distinguish analysis from execution. A report can be available while actions still need approval; inspect the recorded outcomes before treating the response as complete.
- 01Virtus Triage
Configure whether an escalation creates a case and starts Pilot.
- 02Agents
Open the investigation to review findings and its IR Report.
- 03Approval Center
Review the Virtus Pilot pending actions and the Investigation Plan & Hypothesis.
- 04Automatio Studio
Where licensed, put a Human Approval step before a response action that needs a decision.
Pilot never closes a case. Automatio belongs to SecOps Platform; playbook approval gates are explicit workflow choices, and Human Approval defaults to rejection on timeout.
03 - How it connects
Use investigation inside the procedure.
Pilot supplies an investigation plan; Automatio defines a repeatable procedure around it. Casebook holds the customer’s evidence and ownership, so the analyst can continue the work after reviewing the run.
Works with
In the editions
The PortalOutside the defaults
Discuss a license covering AI and provider operations.
Autonomous SOCIncluded
Virtus Pilot is included; Automatio needs SecOps Platform.
SecOps PlatformIncluded
Includes Virtus Pilot and Automatio.
04 - What it means for your service
Consistent investigations across customers.
Cases routed to Virtus Pilot follow the same eight phases and end in an investigation report your analysts can review. Your team starts from findings and a plan instead of gathering context, and decides on the actions that need a person.
Context already gathered
Analysts review the findings and plan produced by the run.
Execution stays governed
Modes, risk settings and approval lists control planned actions.
A report to review
Use the investigation report and action results to explain the work.
Start with one customer
- 01Select one procedure
Choose an escalation or case rule for the customer.
- 02Check execution controls
Review the mode, approval list and connector permissions.
- 03Inspect a complete run
Check the report and pending actions before expanding use.
Questions about Investigation and response.
1Can one playbook be deployed to several customers?
Yes. An authorized operator can deploy an enabled, validated playbook to selected tenants. Deployment creates a tenant-specific copy and records its relationship to the source.
A deployment can be removed from one tenant without removing the source playbook or another tenant’s copy. Check each tenant’s connector setup, permissions and approval configuration before putting the workflow into use.
2Can Pilot isolate a customer’s host on its own?
Isolation is on the default approval-required list, and automatic approval defaults to low risk. Both the risk threshold and approval list matter in Autonomous mode. Guided mode queues planned actions for approval; audit mode skips execution. Review the effective configuration and connected action before enabling automatic containment.
Have any other questions? Talk to our team
Repeat the investigation.
Review the response.
Walk through a customer case and its approval controls with the Imperum team.