Operations Funnel

Last 24h

Events of Interest

Correlation Instances

Alerts Generated

Signal / Noise

MTTD

Analyst Queue

Efficiency Report

How well raw signal converts to actionable alerts

Last 24h

Correlation efficiency

Alert yield

MITRE coverage

Pipeline Health

Ingest → normalize → fuse → correlate → alert

Live

Ingest

Connector → raw events

Normalize

OCSF mapping

Fuse

Alert fusion

Correlate

Cross-source correlation

Alert

Final alert emission

Security Operations Center

Entity-risk alerting, confidence-scored triage, and 0 connected sources

Active Alerts

0 new today

Critical

Require immediate action

Open Cases

0 in progress

MTTR

Mean time to resolve

Connected Sources

EDR, SIEM, Cloud, IAM, SaaS

Alert Volume (24h)

Last 24 hours

Severity Breakdown

Critical

High

Medium

Low

Info

Top MITRE ATT&CK Tactics

Connected Sources

Live Feed

Connecting…

No live events yet. Alerts stream here in real time once a connector is sending data.

SOC Performance

Outcome metrics, agent calibration, and technique coverage. Auto-computed every 30s.

SOC Performance Metrics

MTTD0.0hrs

MTTR0.0hrs

MTTC0.0hrs

Escalation Rate0.0%

False Positive Rate0.0%

Alert Volume (7d)0

Cases Opened (7d)0

Cases Closed (7d)0

Analyst Overrides (7d)0

Agent Confidence Calibration (7d)

Predicted confidence vs. actual true-positive rate. Diagonal alignment indicates well-calibrated confidence.

Not enough labeled investigations to compute calibration yet.

ATT&CK Technique Heatmap

No ATT&CK data in the selected period.

Investigation Cost Telemetry (30d)

Tokens · Latency · Spend per model, aggregated across runs

Source of truth for TCO transparency. Per-run breakdowns are available on each investigation detail view.

No investigation runs with cost telemetry in the last 30 days.