Kandaro and your SOC

Where Kandaro sits

A SOC, whether it is staffed by people, run by a provider or automated by an AI SOC platform, works through alerts from your SIEM, EDR, identity and cloud tools. Most of its effort goes into deciding which alerts are real. A decoy has no legitimate use, so a Kandaro incident needs far less of that work: nobody should have touched it. That makes it a good candidate for automatic escalation.

• Deception feeds the SOC. Incidents arrive with a severity, a plain-English explanation, a recommended action and MITRE ATT&CK techniques.
• Emulation will test the SOC. It is in development. It will run attack techniques in your environment and report whether each step was blocked, detected or missed, whoever or whatever does the detecting.

Kandaro Investigation

Kandaro Investigation is in development and not available yet. It will be an AI SOC inside the Kandaro Console: it will investigate the alerts from your EDR, SIEM, identity and cloud tools together with Deception incidents and Emulation results. Everything on this page keeps working when it arrives, so nothing you set up now is wasted.

Ways to connect

• SIEM connectors for Splunk, Elasticsearch and Microsoft Sentinel. Choose this when your SOC or AI SOC platform reads from the SIEM.
• Signed webhooks for a SOAR tool, a ticketing system or anything else that accepts HTTP.
• The API when a tool needs to pull, or when your SIEM is not reachable from the internet.
• The MCP server when an AI agent should query Kandaro directly during an investigation.

Suggested handling

• Treat highConfidence: true (a planted credential or breadcrumb was used) as a confirmed intrusion. It is sent whatever the channel’s minimum severity is.
• Use sourceIp as the pivot. It is a machine in your network that touched something it had no reason to touch, and it is what to look up in your EDR.
• Add your own scanners and monitoring tools to the ignore list, so they never open an incident.
• Correlate on the ATT&CK technique ids. They come from a fixed table, so they are stable enough to write rules against.

If an AI reads the alerts

Attackers control part of what a decoy records. Kandaro keeps that text in clearly named fields (attackerInput in webhooks and the API, attacker_input in SIEM findings), shortens it, removes invisible characters and masks captured passwords. Configure your AI SOC platform to treat those fields as evidence only, and keep a person in the loop for containment actions.

What Kandaro does not do today

• It does not ingest or triage alerts from your other tools. That is what Investigation is being built for.
• It does not take response actions in your SIEM, EDR or network.