Scope an incident in 30 minutes, not 4 hours

When an incident is declared, ManySignal immediately begins graph traversal from the initial indicator: tracing authentication chains, lateral movement paths, data access events, and persistence mechanisms across all ingested log sources. Within 30 minutes of declaration, the responder has a preliminary scope map showing affected systems, affected accounts, and the attack's progression. This replaces the first 2-4 hours of manual data collection.

Yes, within configured approval thresholds. ManySignal can autonomously isolate endpoints (via EDR), suspend identity accounts (via Okta, Entra ID), revoke API tokens, and block IP addresses at the firewall and cloud security group level. Higher-risk actions (production database isolation, bulk account suspension) require on-call approval via Slack or PagerDuty one-click approve. All containment actions are logged with timestamps to the case record.

ManySignal generates a signed evidence package for every investigation: SHA-256 hashes of all source log evidence, a chronological action log showing every query run and every action taken and by whom, analyst notes with timestamps, and a chain-of-custody certificate. The export format is accepted by eDiscovery platforms and can be presented to legal teams and regulators as incident documentation.

Yes. ManySignal integrates with TheHive, Palo Alto XSOAR, and Splunk SOAR. Evidence packages, timelines, and IOC lists can be automatically pushed to open incidents in these platforms. Bidirectional sync ensures that analyst notes added in the IR platform appear in the ManySignal case, and vice versa. Responders can work in their preferred interface without losing context.

The 'live attacker' dashboard shows all entities with an open high-confidence finding, active sessions flagged as anomalous, and recent lateral movement indicators. The real-time view updates as new telemetry arrives — responders can see whether the attacker is active, quiet, or eradicated without manually querying logs.

Yes. Each affected entity has a blast-radius score showing how many additional resources are reachable from it. Responders prioritise containment of high-blast-radius entities first — typically the credential or pivot point the attacker is using for lateral movement. The attack chain view shows which containment action would cut the most paths.

ManySignal automatically places all events related to an open case on legal hold — preventing retention policy deletion until the case is closed and the hold is released. Forensic timeline exports can be triggered at any point during the investigation. In parallel, the investigation agent flags new matching events as they arrive, keeping the evidence set current.

In environments without automated triage and response, median time to eradication (full containment and eviction) ranges from 12–48 hours for a credential-based attack. ManySignal customers report median eradication times of 2–6 hours — primarily because scope determination is complete within the first hour and containment actions can begin while investigation continues.

The case close report generates a structured incident report: timeline, attack chain, affected entities, containment actions, eradication steps, and root cause analysis. The lessons-learned section is analyst-authored within the case, preserved with the evidence package. The report is formatted for C-suite briefings, regulator submissions, and internal security review boards.