Incident help Talk to our team

Steward | Investigation

Follow the whole story behind an alert.

Steward is investigation software for SOC and DFIR teams, and it's what our own analysts use every day. It links the accounts, devices, mail, cloud activity, past cases and analyst decisions behind an alert into one case. It works through the evidence on its own, stops when the evidence runs out, and leaves every change to your records to a person.

See it on one of your cases How it works

Steward at work

Watch Steward work one case.

From a crowded alert queue to a case you can defend.

Tools we work with

Connected to the tools you already run.

Steward reads from your security tools through Omni, and Automaton sends the follow-up work to the places your team already uses.

Endpoint

  • SentinelOne
  • CrowdStrike Falcon
  • Microsoft Defender
  • Sophos Central

Identity and email

  • Microsoft Entra ID
  • Microsoft 365
  • Google Workspace

SIEM and detection

  • Rapid7 InsightIDR
  • Microsoft Sentinel
  • Lumu

Cloud, edge and code

  • AWS
  • Cloudflare
  • GitHub
  • Qualys VMDR

Follow-up with Automaton

  • Slack
  • Microsoft Teams
  • Jira
  • Confluence
  • ServiceNow
  • PagerDuty
  • Okta
  • VirusTotal
  • AbuseIPDB
  • urlscan
  • GreyNoise
  • Email

What we can do in each tool depends on the tool and on the access you grant. Some are read only, and some also support response actions like isolating a device. We'll go through yours on the first call.

The problem

Attackers move across systems. Alert queues don't.

An intruder goes from a phished mailbox to a laptop to a cloud console. Your tools see three unrelated alerts in three consoles, and somebody has to piece it back together by hand while the attacker keeps going.

An alert is a fragment

It tells you something happened. It doesn't show how the account, the device and the process connect. Steward fills in those links so analysts spend their time on the decision.

You already bought the stack

Steward reads from the SIEM, EDR, identity and case tools you already have. You get more out of what's in the budget, without a migration.

Confident isn't the same as right

When the evidence doesn't support a verdict, Steward says so and asks a person. It won't dress a guess up as a finding that falls apart in the review.

How it works

Four steps from alert to a case you can defend.

  1. Collect

    Read alerts and activity from the tools you run, through your own Omni. Credentials stay with you.

  2. Connect

    Link people, accounts, devices, processes, files, network activity, alerts, past cases and decisions, in time order.

  3. Investigate

    Steward asks the next question, gathers the evidence and checks the harmless explanations. Analysts make the calls.

  4. Close

    Every case ends with a written outcome. Updates to your case tool are proposed first and wait for a person.

Built to stop

Knowing when to stop is part of the answer.

Steward is designed to pause when the evidence is weak. It writes down what it isn't sure about, tests the innocent explanation, and shows how it reached each conclusion.

  • Incomplete or contradictory evidence goes to an analyst, with the open questions attached
  • Two records merge only when their identifiers clearly match, and weaker links are labeled as possibilities
  • The questions, the evidence and the reason for the verdict stay with the case
Decision record

Another analyst can walk the same path

Every question asked and every piece of evidence reviewed is logged against the case, step by step, so a reviewer sees more than a summary.

Your boundary

Logs stay in the SIEM or data lake you already run.

No stored keys

It reaches your tools through Omni, never with its own credentials.

A system that can't stop isn't ready to close an investigation.

What it is

  • Case-centeredYou work with the people, machines and events in a case, not a chat window bolted onto a ticket.
  • Built to fit inWorks alongside the SIEM, EDR, identity and case tools you already own.
  • Made for analystsFor SOC analysts and DFIR leads who need a clear evidence trail and decisions others can follow.

What it is not

  • Not a SIEMKeep the platform that holds your logs. Steward reads from it.
  • Not a SOAR canvasNo flowcharts to maintain. A clear case structure is easier to review than a playbook that breaks on the first odd alert.
  • Not a model companyWe build the controls around the AI, including the point where it has to stop and ask.

Two ways to use it

Run it yourself, or let us run it for you.

Steward for your own SOC

Your analysts work their cases in Steward, with access to your tools managed through Omni. You keep full control of who can do what.

Ask about Steward

Steward inside our service

Our analysts use Steward to run your security operations around the clock, and you can open any case to see what we did.

See Security Operations

See Steward on one of your own cases.

Bring an alert from your queue and we'll work it through with you.

Talk to us about Steward