Raw alert

• View full alert details
• Access raw JSON data
• Link to Sentinel source
• Verify origin & evidence

The OSCAR methodology

• Investigate via OODA loop
• Ask: malicious or benign?
• Gather & synthesize proof
• Take automated action

Evidence

• API based data queries
• Collect config & context
• Threat intel integrations
• Full audit of findings

Analyst Engagement and Feedback

• Mark alerts as malicious
• Save analyst conclusions
• Build adaptive context mem
• Learn from team feedback

AI interviewer

• Auto user investigation
• Multilingual interviews
• Human-in-loop optional
• Add verified insights

Custom strategies

• Define org-specific rules
• Tag benign vs malicious
• Plain English conditions
• Encode reasoning logic

Architecture + Compliance

• Secure on-prem connectors
• Zero customer data train
• Built-in TI integrations
• Transparent AI providers