LIVE SOC SUPERVISION TERMINAL // MULTI-TENANT
The console

What an MSSP evaluates before signing.

Not marketing — the authenticated product. Dozens of customers from one place, the human-in-the-loop governance made visible, and the regulatory clock sitting next to the attack path.

AEGIS // OPSGroupe Valmonttenant 7 of 24
14 208 events/sResponse mode
monitorapprovalauto
Incidentslast 24h
CRITICAL2m ago
Pre-encryption activity on FIN-SRV-04
FIN-SRV-04contained
HIGH19m ago
Impossible travel — 3 sign-ins, 2 countries
m.dubois@investigating
HIGH1h ago
Unusual outbound volume to new ASN
WEB-EDGE-01investigating
MEDIUM4h ago
Privilege escalation attempt blocked
HR-WS-22closed
MEDIUM9h ago
Honeypot token touched
DECOY-FSclosed
CRITICALINC-2026-0841 · ransomware staging

Pre-encryption activity on FIN-SRV-04

Evidence vaultReview filing
The story AEGIS assembled — 14 signals
  1. T+0s
    Shadow-copy deletion attemptedT1490 · vssadmin.exe
    agent
  2. T+3s
    Mass file-handle open across 3 sharesT1486 · entropy spike
    agent
  3. T+11s
    Host isolated from networkcontain · analyst approved
    human
  4. T+40s
    Backup integrity verified — cleansnapshot 04:00 intact
    agent
  5. T+4m
    NIS2 24h early warning draftedready for review
    agent
Attack path

From FIN-SRV-04 there are <strong style="color:#fff;">two hops</strong> to the payroll database. The graph flagged this route before the attacker used it.

FIN-SRV-04 → SQL-02 → PAY-DB
Regulatory clock

NIS2 early warning drafted. <strong style="color:#fff;">21h 38m</strong> remain in the 24-hour window.

awaiting human review → CSIRT
Proposed next action — disable service account svc_backup

Destructive action. Gated in every response mode, including full auto.

AI guide — sovereign operations