Endpoint monitoring & investigation
The Windows collector and core investigation model exist. Broader endpoint coverage and deeper telemetry are being developed.
SNOOW – AGENTIC AI SOC PLATFORM
Investigate security threats
faster with Agentic AI
SNOOW brings security telemetry, threat detection, AI-assisted investigation, human-controlled response and incident reporting into one unified SOC platform.
Currently available for pilot evaluation.
PilotControlled evaluation
AIAssisted investigation
HumanResponse approval
Endpoints
Network
Cloud
SNOOWAgentic AI SOC
Threat Detected
AI Investigation
Analyst Review
Response
From signal
to security.
◉ Security Monitoring△ Threat Detection⌕ Incident Investigation⇄ Controlled Response⌘ SOC Workflow Automation
PRODUCT AVAILABILITY
A clear view of what comes next.
SNOOW is under active development. Pilot scope is agreed with each organisation; the capabilities below are not a general-availability commitment.
Endpoint response
Decision and Action agent foundations exist. Response coverage, reliability and approval controls are being expanded and validated.
Identity security
Native identity telemetry, account-risk context and controlled identity response are on the roadmap.
Network analytics
Native network ingestion and analysis of firewall, DNS, proxy and flow activity are on the roadmap.
THE SECURITY OPERATIONS CHALLENGE
Security operations are fragmented, expensive and difficult to scale.
Security teams often work across disconnected tools, alerts and workflows, increasing investigation time and operational complexity.
Fragmented security data
Security information is distributed across endpoints, cloud platforms and multiple security products.
Manual investigation
Analysts spend significant time gathering context and correlating evidence manually.
Difficult to scale
Smaller organisations may not have the resources required to maintain large security operations teams.
Slower response
Delayed investigation and fragmented workflows increase the time required to understand and respond to incidents.
THE SNOOW PLATFORM
One intelligent platform for security operations.
SNOOW combines telemetry, detection, investigation, decision support and controlled response into one operational workflow.
Telemetry Collection
Build on Windows endpoint collection, with broader collector coverage under development.
Detection & Correlation
Identify suspicious activity through rules, behavioural logic and event correlation.
AI Investigation
Enrich alerts, correlate related activity and build an investigation timeline.
Decision Support
Recommend whether an incident should be blocked, escalated or monitored.
Human-Controlled Response
Require analyst approval before executing sensitive response actions.
Automated Reporting
Generate investigation summaries, evidence and recommended next steps.
HOW SNOOW WORKS
From telemetry to analyst-approved response.
AI accelerates investigation and decision support. Security teams remain in control of sensitive actions.
✓ HUMAN-IN-THE-LOOP
Automation where it helps. Human control where it matters.
FIVE SPECIALIST AI ROLES
Evidence connects every step.
SNOOW's agentic workflow is designed to pass a shared incident record between specialist roles. Each adds context, while evidence, uncertainty and human decisions stay attached.
- 01
Detection
Explains why an alert matters and prioritises it using observed signals.
Passes on: alert, source evidence and detection context. - 02
Investigation
Connects related events, assets and indicators into a timeline, flagging missing evidence.
Passes on: timeline, evidence references and confidence. - 03
Decision
Recommends monitoring, escalation or response, with an evidence-linked rationale.
Passes on: recommendation, rationale and policy checks. - Human approval before sensitive actions
An authorised analyst reviews the evidence and approves or rejects the recommendation. A rejected action does not execute.
- 04
Action
Executes only permitted actions with the required approval and records success or failure.
Passes on: approval record, execution result and audit evidence. - 05
Reporting
Produces an incident narrative that distinguishes observed facts, inference and recommendations.
Produces: an analyst summary and traceable incident record.
Product workflow direction; available steps depend on the agreed pilot scope.
UNIFIED SOC CONSOLE
Understand an incident without jumping between tools.
SNOOW is being designed to bring the information analysts need into a single investigation experience.
- Security overview
- Alert queue
- Investigation timeline
- AI investigation summary
- MITRE ATT&CK mapping
- Recommended response
- Analyst approval panel
- Reports and evidence
SNOOW INVESTIGATIONIllustrative scenario
INCIDENT SUMMARY
Suspicious authentication behaviour
Multiple authentication failures followed by a successful sign-in from an unusual source.
Threat score86 / 100
SeverityHigh
MITRET1110
RECOMMENDED RESPONSE
Review session and isolate the affected endpoint.
Analyst approval required
USE CASES
Built around real security operations workflows.
Centralized Monitoring
Bring important security telemetry into one operational view.
Endpoint Telemetry Analysis
Analyse endpoint activity and security events as part of an investigation.
Alert Investigation
Enrich alerts and correlate evidence before an analyst makes a decision.
Incident Prioritization
Organise investigation context so analysts can focus on higher-priority incidents.
Human-Approved Response
Keep sensitive response actions under analyst control.
Investigation Reporting
Structure evidence, summaries and recommended next steps into consistent reports.