Imperum SecOps Platform brings detections, case management, response playbooks and endpoint forensics into one working environment. Your team can investigate an alert, act with the right context and leave a clear record for the next analyst.
An analyst or rule creates or groups a case.
Run history stays linked to the case.
A deployed detection rule produces an alert. An analyst or a configured rule can create a case or group it with related alerts.
Casebook brings the alert, entities and investigation notes together. The team can set ownership and follow the work through its stages.
A selected playbook receives the case’s available context. This example pauses at a configured human approval node; its run remains linked to the case.
An analyst inspects collected endpoint events and records findings in the case notes. The response is still awaiting approval; evidence collection does not close the case.
Author or import detection rules, deploy the ones you need and inspect the alerts they produce. Keep the rule and the matching activity close enough to understand why work entered the queue.
Prepare the ruleReview the pattern and the data it needs.
Deploy deliberatelyRule auto-deploy is off by default.
Inspect the matchUse the alert’s context to start investigating.
A traceable starting point. Analysts can follow the detection into the investigation instead of working from a severity label alone.
Explore Detection LakeCasebook holds related alerts, entities, notes and the investigation timeline. Run a playbook from the case and review its execution history there. The next person can pick up the work with its context intact.
Recommends a priority from signals such as alert severity, threat intelligence and entity risk. When available, Cerebrum’s machine-learning estimate of false-positive likelihood adds context. Priority updates follow your configuration.
Help the team decide what to investigate first.
Ranks eligible analysts using skills and available capacity. A trained tenant model can add learning from closed-case history; deterministic ranking provides a fallback. Assignment follows the configured routing policy.
Match the work to the people who can take it.
Automatio connects triggers, actions and conditions in a visual workflow. A case can supply the host, user and indicators a playbook needs. Connector actions perform the work, and configured approval steps give the team a decision point.
This example waits at an explicit human approval node. Select a path to see what happens next.
Repeat the procedure, keep the evidence of the run. Execution history shows which steps ran and what they returned, so the team can review the response.
Explore AutomatioCollect endpoint artifacts, search the indexed evidence and inspect events on a forensic timeline. Filter by host and time, then open an event to examine its detail. The chronology helps the analyst test an explanation against the evidence.
Establish which account was active before the process event.
Review the command and its surrounding activity. An encoded argument alone does not establish malicious intent.
Investigate the destination and correlate it with other evidence before drawing a conclusion.
A clearer basis for the next decision. Keep the findings and the reasoning with the investigation so another analyst can review them.
Explore Digital ForensicsSecOps Platform extends Autonomous SOC with operational surfaces including Detection Lake, Automatio and endpoint forensics. Alerts and Cases are shared foundations. Access depends on your license, permissions and configured services.
Choose the event sources and endpoint evidence needed for the investigation.
Check the case context, connector actions, approval steps and timeout policies.
Review the playbook run and save the findings that support the next decision.
Autonomous SOC provides the AI capabilities and analyst-facing workflows. SecOps Platform extends that foundation with operational surfaces such as detection management, playbook automation and endpoint forensics. Cases are available in both. Individual module grants and permissions still apply.
No. Cases can be opened by analysts or configured workflows. Playbooks can run against a case, and forensic investigation is available when endpoint evidence is needed. The illustration shows one example, not a mandatory sequence.
No. Approval depends on the action, playbook and applicable policies. A human approval node creates an explicit decision point with approved and rejected paths; timeout behavior is also configurable. Review those controls when designing the procedure.
The forensic timeline presents indexed endpoint events. In the workflow shown here, the analyst reviews those events and records the relevant findings in the case notes. It does not represent automatic attachment of every collection or automatic case closure.
Have any other questions?
Talk to our team
See how your team could connect the alert, the response procedure and the evidence in Imperum.