Endpoint monitoring & investigation
The Windows collector and core investigation model exist. Broader endpoint coverage and deeper telemetry are being developed.
SNOOW PRODUCT
SNOOW – Agentic AI SOC Platform
SNOOW is being built to unify security telemetry, detection, investigation, decision support, human-controlled response and incident reporting in one modern SOC platform.
In development · Pilot evaluationPRODUCT AVAILABILITY
A clear view of what comes next.
SNOOW is under active development. Pilot scope is agreed with each organisation; the capabilities below are not a general-availability commitment.
Endpoint response
Decision and Action agent foundations exist. Response coverage, reliability and approval controls are being expanded and validated.
Identity security
Native identity telemetry, account-risk context and controlled identity response are on the roadmap.
Network analytics
Native network ingestion and analysis of firewall, DNS, proxy and flow activity are on the roadmap.
Designed for modern SOC teams
Reduce operational fragmentation
Security teams often work across separate tools for telemetry, detection, investigation, orchestration and reporting.
SNOOW is designed to reduce dependence on fragmented and expensive security tooling while keeping external integrations available where needed.
Pilot Stage
Built for controlled evaluation
SNOOW is currently being developed and validated through controlled pilot deployments.
Product capabilities are evolving as telemetry, AI investigation, response controls and platform reliability continue to mature.
CORE CAPABILITIES
One intelligent platform for security operations
Telemetry Collection
Build on Windows endpoint collection, with broader collector coverage under development.
Detection and Correlation
Identify suspicious activity using rules, behavioural logic and event correlation.
AI Investigation
Enrich alerts, correlate related activity and build investigation timelines.
Decision Support
Recommend whether an incident should be blocked, escalated or monitored.
Human-Controlled Response
Require analyst approval before executing sensitive response actions.
Automated Reporting
Generate investigation summaries, evidence and recommended next steps.
FIVE SPECIALIST AI ROLES
Evidence connects every step.
SNOOW's agentic workflow is designed to pass a shared incident record between specialist roles. Each adds context, while evidence, uncertainty and human decisions stay attached.
- 01
Detection
Explains why an alert matters and prioritises it using observed signals.
Passes on: alert, source evidence and detection context. - 02
Investigation
Connects related events, assets and indicators into a timeline, flagging missing evidence.
Passes on: timeline, evidence references and confidence. - 03
Decision
Recommends monitoring, escalation or response, with an evidence-linked rationale.
Passes on: recommendation, rationale and policy checks. - Human approval before sensitive actions
An authorised analyst reviews the evidence and approves or rejects the recommendation. A rejected action does not execute.
- 04
Action
Executes only permitted actions with the required approval and records success or failure.
Passes on: approval record, execution result and audit evidence. - 05
Reporting
Produces an incident narrative that distinguishes observed facts, inference and recommendations.
Produces: an analyst summary and traceable incident record.
Product workflow direction; available steps depend on the agreed pilot scope.
Telemetry
Native telemetry collection direction
SNOOW is being designed to collect security telemetry directly wherever practical, rather than requiring premium commercial security products as mandatory dependencies.
- Windows endpoint telemetry
- Linux endpoint telemetry
- API and webhook ingestion
- Authentication activity
- Process and network activity
- Security and application events
Vendor-Independent Direction
Native first. Integrations optional.
Premium commercial security tools can be supported where customers need coexistence, migration or additional data sources, but they are not intended to be required for SNOOW's core capability-flow.
PRODUCT CAPABILITY FLOW
From collected signal to controlled action.
WHO SNOOW IS FOR
Designed for growing security teams
SOC Analysts
Investigate alerts, review evidence and manage incidents from one console.
Incident Responders
Review timelines and make informed response decisions.
Detection Engineers
Build and improve detection and correlation logic.
Security Administrators
Manage telemetry, collectors, access and policies.
Security Leaders
Review incidents, operational evidence and reporting outcomes.
Managed Security Providers
Evaluate a unified operating model for security investigations and response workflows.