Early MVP in bounded private evaluation; integration verification pending. Not public SaaS. No live connectors or customer data behind this website.
ONE INVESTIGATION PATH
From noisy inputs to reviewable decisions.
Query, signals, rules, ATT&CK context, cases, infrastructure and cost belong in one operational story—not another disconnected dashboard.
BOUNDED QUERIES + SOURCE EVIDENCE
Ask a focused question. Keep the original in reach.
Typed filters query hot ClickHouse data. Authorized historical requests use Iceberg through PyIceberg, never a silent hot-data fallback. Inspect OCSF, raw references and provenance alongside the match.
POST /api/v1/events/query
{
"status_id": 2,
"limit": 25
}
SQL preview explains the bounded request. An advanced SQL editor and Presto/Trino integration are planned, not connected.
DETECTION-AS-CODE
Know exactly what a rule supports.
Validate a strict, stateless Sigma-like subset. Unsupported operators fail closed. Arroyo matches feed durable PostgreSQL alert, case, narrative and outbox state through a broker-backed path.
Exact scalar matches. Conjunctive selections. No count, correlation, windows or joins in the current rule compiler.
ATT&CK tags are declared metadata, not proof of technique coverage.
HUMAN-CONTROLLED RESPONSE
Approve the plan. Not a moving target.
Preview local case assignment, priority and notes. Approval binds the digest, case revision, workflow version, policy and expiry. Inspect the durable result and audit trail.
Deterministic narratives remain independent of inference. System One is planned advisory support with no action authority. External ticket integrations are planned; current delivery is local-console outbox.
VISIBLE LIMITS + COST PROVENANCE
Unknown is a status. Not a zero.
Read operation receipts and per-lane completion before acknowledging source delivery. Distinguish estimated, observed, billed and unavailable cost evidence.
The cost API reads a configured snapshot. Cloud inventory and billing are not connected by default. Budget communications are not connected.
CUSTOMER-CONTROLLED FOUNDATIONS
Your storage is the anchor. Not a vendor control plane.
A private-compatible architecture with explicit evidence, delivery and authority boundaries. Component selection is not production qualification.
ACQUIRENative audit sources
AWS CloudTrail, Google Workspace and a bounded CloudWatch sample adapter. Other source families—including GCP Cloud Logging and Azure Activity Log—remain planned.
ANALYZEClickHouse + Arroyo
Bounded hot queries and streaming rule execution. PostgreSQL owns operational state, receipts, audit and local outbox.
RETAINIceberg + Parquet
Customer-controlled object-store history via PyIceberg. Raw retention, holds, recovery and deletion policy require deployment qualification.
The current profile is a bounded, single-node evaluation—not a general-availability service, compliance certification, or production HA claim.
PRIVATE INSTALL
Keep the data plane in your environment.
The full product has an in-VPC deployment path, including UI/API, operational state, archive and checkpoints. No mandatory vendor control plane. Hosted egress is opt-in.
Account for compute, retained volumes, object storage, requests and private endpoints. Stopping compute does not stop every charge. No public price or savings guarantee is offered here.