Built to make defenders faster.

Assign to an analyst, add notes, link an investigation, or spin a follow-up hunt straight from an item. A timeline across the three lanes is marked by severity and source, and the rail badge shows the new count each viewer can actually see.

Items move through a clear lifecycle: new, acknowledged, assigned, investigating, resolved. A recurrence refreshes an open item instead of burying you in duplicates.

• Visibility follows the source hunt's sharing; EBA alerts are visible to all
• Open the hunt, ask Sati about the item, or create a new hunt from it
• The default view is everything not yet resolved

The first verdict comes from repeatable scoring rules, with the signals behind each dimension available to inspect. The second is Sati's assessment of that evidence, with its estimated confidence and the likelihood of a benign explanation. These are AI assessments for this case, not measured accuracy or false-positive rates.

Recommended actions arrive as a checklist. What's worth validating is listed separately, so a less experienced analyst gets a structured first call rather than a raw event dump. Hunt related activity is one click.

• Account or host, identified however you have it: UPN, SID, hostname, device id, address
• Sources and coverage are shown for every run; a dimension without data says so
• Deep analysis adds a kill chain and ATT&CK techniques, each citing its events

Ask Sati reads what you can see: the mapped tables, the environment's knowledge, your hunts and your findings. For a simple question it runs a query and answers. For a complex one it pushes back, recommends a hunt type with real knowledge of each, and helps you shape the premise.

And it can retrieve events straight into an investigation for you to review: every network event from one PC to one domain, say, carried in with the correlated fields already attached, through the same path a hunt uses.

• Every answer from the lake carries a receipt and an Open in Search link
• Result tables are capped on screen with the rest available to download, so a list answer is never silently cut short
• Times are shown in your own zone; it understands Search's query language

You see the plan, the explanation and every query as it's issued, and you can redirect or stop the hunt. A second pass attaches supporting events to findings, helping you assess the evidence and identify gaps or unresolved questions.

Six hunt types ship, each shaping the agent for a different question: intrusion, insider, hygiene, IOC, general, and EBA discovery. Sati uses your environment knowledge to assess whether activity fits the tools, systems and behavior your team expects.

• Every hunt runs against a token budget, tracked live; extending it is your decision
• It characterizes the data in aggregate first, then pulls raw detail only where a signal warrants
• Intrusion and insider hunts emit an interactive attack timeline for the report

Sign-ins, mail, SharePoint, Okta, Defender: the same person is a UPN in one system, an object id in another, a short name in a third. Sati resolves them to one subject and expands the search to every form it knows, including previous hostnames and directory aliases.

Sati's custom Directed Search Language (DSL) lets analysts search raw fields or normalized concepts and combine conditions with familiar Boolean logic.

user=rroe expands the field as well as the identity. Depending on the table, user can map to Username, Account, InitiatingProcessAccountName or targetAccountName. Concepts such as host, process, IP and URL expand to their mapped fields too, so analysts don't need to memorize each table's field names.

Once retrieved, results are held in server memory. Filtering, sorting, searching within the results and field analysis run against that in-memory set for near-real-time exploration, without another warehouse query for each refinement.

• Original fields stay exactly as the source wrote them; correlated and enriched fields sit beside them
• A bare value, with no field named, is searched across every field of every table
• Every search, filter and pivot is recorded on a trail you can step back along

Each flagged event carries a score and the signals behind it, so you can see why it was flagged and read it in place, between the events that came before and after. Pips on the timeline show when the anomalies fell.

The threshold is calibrated automatically and yours to move. The same detection runs over a fresh search and over the curated events inside an investigation.

• Scores explain themselves: rare action, 2 of 95, 2.1%
• Detectors can be switched off one at a time
• Geo and network-owner enrichment feeds the location and proxy signals

External threat treats the case as a possible intrusion. Insider threat reads the same events for misuse of legitimate access. Local anomaly frames it as a departure from this environment's own normal. Each produces a completeness rating, the key unknowns, an attack story, an assessment of the entities involved, where to scope next, and a threat-actor profile.

Follow cited events back to the evidence and assess the explanation yourself. Sati checks that event references exist; the analyst evaluates whether they support the conclusion. Completeness is an AI assessment of the case, with remaining questions identified.

From the curated evidence the investigation produces an incident report, a timeline and an executive briefing. Sati annotates the key events inline, explains any single event on request, and answers questions over the case in its own thread.

• Sati doesn't see raw dumps: a sweep or spray is faithfully aggregated first, and the full rows stay in the case as the evidence pack
• Star, tag and annotate events; notes carry their author
• Report, timeline and briefing from the case; export as PDF, or the whole case as JSON or CSV