The AI SOC that investigates every alert.
Most alerts never get a proper look. Kandaro Investigation will take the alerts from your EDR, SIEM, identity and cloud tools, together with Kandaro’s own, investigate each one, and tell you in plain English which ones matter, why, and what to do about them.
Alert queue · investigated
- Kandaro DeceptionDecoy NAS login from 10.20.4.77Escalated
- EDREncoded PowerShell on FIN-WS-114Escalated · same machine
- IdentitySign-in from a new country for j.devriesClosed · company VPN exit
- CloudStorage bucket policy changedNeeds a person
Illustration of planned functionality; details may change before launch.
What we’re building
What Kandaro Investigation will do
A verdict for every alert
Each alert will be escalated, closed as benign or handed to a person, with the evidence behind the decision. Nothing sits unread in a queue.
Investigations you can check
Every verdict will show the steps the AI took and the data it looked at, so an analyst can confirm it in minutes instead of redoing it.
Connects to the tools you run
Planned connections to EDR, SIEM, identity and cloud platforms, read-only by default, so alerts are judged together instead of one tool at a time.
A recommended response
Concrete containment steps for each incident. Investigation decides and recommends; it never executes anything. Carrying a response out is the job of Kandaro Protection, on your approval.
Built to resist manipulation
Alerts contain text written by attackers. It will be kept apart from the AI’s instructions, and rules set a minimum severity the AI can raise but never lower.
A record you can show
Every alert, verdict and action kept as an audit trail, for your own reviews and for auditors.
Part of the Kandaro platform
Deception gives it certainty. Emulation keeps it honest. Protection acts on it.
A decoy hit has no innocent explanation, so Investigation will use Deception incidents as fixed points when it weighs other alerts from the same machine. Emulation will attack on a schedule and show whether Investigation caught each step. When you approve a response, Protection will carry it out.
- Every finding explained in plain English
- Same account, same MFA, same Console
- Same alert channels and webhooks
Early access
Be first in line.
Kandaro Investigation is in development. Join the waitlist and we’ll invite you to early access, and tell you about pricing before launch.
Need protection today? Kandaro Deception is live.