Skip to content
Explore solutionsSOC Operations
Imperum for SOC Operations

Move the case forward.
Keep the context.

Imperum connects triage, investigation, response and handoff for SOC operations teams. AI agents build context and handle configured actions; your analysts review uncertain alerts, control response decisions and carry open work into the next shift.

Evidence-led triageControlled responseTraceable handoffs
One incident. Across the shift.Synthetic example
MONITOR & TRIAGE
Incoming alertSuspicious PowerShellFIN-WS-07 · EDR
Virtus TriageEscalateContext + reason + verdictCase creation configured
CASEBOOK · SOC-2041Investigate the endpoint
Open
Incoming analyst · J. Lee
A record the next analyst can use
  1. Triage reason attachedEncoded command needs investigation
  2. Evidence in contextAlert, endpoint and analyst notes
  3. Response run recordedApproval and action result
  4. Shift handoff loggedNew owner and follow-up notes
RESPOND & HAND OVER
Automatio · case playbookIsolate FIN-WS-07Approved → result recordedApproval required in this example
Shift handoffA. Morgan J. Lee“Endpoint isolated. Review persistence next.”
The case stays open for follow-up. A completed response action does not close the investigation.
Build the reason before opening the case. Triage combines alert context, policy and relevant history. In this scenario, the escalation action creates a case for further investigation.
Investigate from the case. The analyst reviews the alert and endpoint context, adds notes and chooses a response. The timeline preserves what happened and who acted.
Approve a specific response. The case supplies the target to a configured playbook. This example pauses for approval before isolation; the run records its result against the case.
Transfer the work with a next step. The outgoing analyst selects the case, chooses the incoming analyst and adds notes. Ownership changes; the case history remains available.

Illustrative sequence, not a live incident or a timing claim. Available actions depend on your licensed modules, connectors, permissions and configured policies.

01 - Monitoring & Triage

Put the reason beside the alert.

Your monitoring team needs to decide what deserves investigation. Virtus Triage gathers context, checks policy and returns a verdict with supporting reasoning. Uncertain work can enter the human review queue, where analysts can correct the verdict.

Virtus Cerebrum adds a local learning path for familiar noise. Eligible alerts can resolve without another LLM call when validated models and automation controls allow it.

Close

Resolve eligible benign alerts under the configured controls.

Escalate

Send incident-worthy work onward, with case creation where configured.

Needs human

Keep uncertainty visible for an analyst to review.

Less reconstruction at first touch. The analyst starts with a reason and context to check.

02 - Case Management

Give the work an owner and a history.

Casebook brings alerts, evidence, notes, response runs and ownership into the investigation. Your case managers can review priorities and service-level targets while the team keeps working from the same record.

CASE ASSIGNMENTExample · Recommend mode
Case context

Endpoint investigation

Threat evidence, affected assets and business context inform the priority.

Priority reviewed by analyst
Recommended by Case Router

A. Morgan

Relevant skills and assignment history inform the recommendation.

A person makes the assignment

Prioritize with the evidence.

Virtus Case Prioritizer combines risk signals into a recommendation. Optional Cerebrum learning signals can inform it; the recommendation keeps its supporting factors visible.

Route with experience.

Virtus Case Router uses analyst profiles and assignment history. Once trained, its tenant-specific machine-learning model helps rank fit. It starts off; automatic assignment requires Auto mode.

Make the assignment explainable. Review why a case needs attention and who is suited to take it.

03 - Incident Response

Turn a decision into a controlled action.

Responders can run Automatio playbooks from a case. Its alert and entity context supplies the inputs; execution history records the steps and results. Approval settings and action risk determine where execution must stop for a person.

Endpoint responseConfigured example
  1. 01Use case context

    Target: FIN-WS-07

  2. 02Request approval

    Review the isolation action

  3. 03Record the result

    Action outcome on the run

Approval permits an attempt. Connector access, target checks and execution results still determine the outcome.

Investigate with Virtus Pilot.

Virtus Pilot coordinates supported investigations and can write findings back to a linked case. Its mode, tool access and approval policy constrain what it can do.

Ask from the case context.

The AI Assistant helps analysts query security data and inspect supporting sources. Responses and tool use remain subject to the analyst’s access and applicable action controls.

Keep the response reviewable. Follow the chosen action into its execution record instead of reconstructing it from separate conversations.

04 - Escalation & Handoff

Change the owner. Carry the reasoning.

Shift leads can see cases approaching or breaching their service-level targets. Automatic escalation is a separate, configured rule. An SLA warning alone does not mean the case has been reassigned.

At shift change, select the open work you own, choose the incoming analyst and add follow-up notes. Casebook updates ownership and writes a Shift Handoff entry to each transferred case.

Shift HandoffSOC-2041 · synthetic case
FromA. Morgan
ToJ. Lee
Endpoint isolated. Review persistence next. Alert evidence and the response run are on the case.
Same case history New owner Clear next step

Give the next shift a place to continue. The incoming analyst gets the case and your notes, without rebuilding the investigation from memory.

05 - Workload & Value

Put a baseline behind the benefit.

Time spent re-triaging alerts competes with investigation time. Compare the work automated in your environment with a manual baseline, then account for the review and follow-up your team still performs.

Planning example · one month · modeled
41h 40m
of manual triage workload represented

100 AI-handled triage decisions × 25 minutes per decision. The decision count is hypothetical; 25 minutes is Imperum’s configurable manual-triage baseline.

This is a workload estimate, not measured time saved. It excludes analyst review, investigation and response after escalation. Validate your own baseline and remaining work before treating it as capacity returned.

Track decisions in their period.

Review triage outcomes and human overrides in the reporting window. A decision to escalate is the start of casework, not an incident resolved.

Check what still needs people.

Use case priorities, service-level status and handoff notes to direct attention to unfinished work. Judge the result by the work your team can complete.

Getting started

Start with one workflow your team knows.

Connect the relevant sources, define how triage hands work to cases, and choose the response and approval boundaries. Then walk an example through to the incoming analyst. This solution spans capabilities across Autonomous SOC and SecOps Platform; availability depends on your license and configuration.

Questions from the shift floor.

1How does triage decide what a human sees?

Virtus Triage builds context, checks policy and validates its verdict. Work that needs human judgment can enter the review queue. Closure and escalation actions depend on configured rules and safety checks; a confidence score alone is not permission to act.

2Can we require approval before response?

Yes. Playbook and action settings can require approval, and critical response actions retain an approval gate. Review the specific action, its target and connector permissions. Approval does not guarantee that execution will succeed.

3Can case updates reach our ticketing system?

Cases can link to external tickets. With ITSM synchronization enabled and a connector configured, case updates can flow to linked tickets through your field and status mappings. Available fields and sync results depend on the integration.

4Does shift handoff automatically move all cases?

The analyst chooses which owned, unfinished cases to transfer and who receives them. The handoff updates ownership, retains the existing history and adds notes to the case timeline. It is an explicit action, not an automatic shift schedule.

Have any other questions?
Talk to our team

Bring the handoff your team
wants to improve.

Walk through an alert, a case and a response decision. See where Imperum can carry the work into your next shift.

Book a 30-minute demo Explore SecOps Platform