Threxendoesn't wait for a SOC analyst to triage. Four agent families work in lockstep — Watchdog watches, Decoy lures, Containment isolates, Playbook hands off — and a human only ever sees the result. Each step below ships as its own dashboard pane, already live in your tenant from day one.
Walkthrough
The cards below describe what the agent is doing on your telemetry. The link on each card opens the matching dashboard pane — already wired into your tenant. Signing in takes you straight there; signed-out visitors are sent through /signin?next=/app/<stage> and returned to the same pane.
See how the same evidence chain reaches the detection planes your SOC already runs in our public SIEM and EDR playbooks →.
Detect
Watchdog agents run continuously on every tenant stream — adversarial-AI prompt patterns, lateral Kerberos abuse, OAuth replay, supply-chain manifest drift. A verdict lands within a second of the first suspicious event, with full attribution trace.
analyst sees
A live verdict stream on /app/watchdog — one row per decision, ranked by confidence, ready to reverse or escalate.
Lure
Decoy agents lay decoy documents, forged SaaS endpoints, and fake kubeconfigs. The moment adversary tooling touches a decoy, it is live-poisoned — fingerprinted, fingerprinted-output captured, and chained into the containment queue.
analyst sees
Every decoy touch on /app/decoys — fingerprinted tooling, dwell-time, and the lateral pathways the actor explored.
Isolate
Confirmed compromises trigger immediate isolation: poisoned sessions revoked, tunnel interfaces shut, lateral pathways severed at the host. Every action is reversibly recorded — a human analyst can rewind the boundary if the decision was wrong.
analyst sees
An auditable trail on /app/containment — diff of containment state, mean time-to-contain, one-click reversal.
Handoff
Profiler agents seal an evidence packet — actor confidence, toolchain map, regulatory framing — bound to the event types the customer's policy packs recognise. Nothing is invented at handoff; everything is signed and replayable.
analyst sees
Per-tenant runbooks on /app/playbooks — bound to watchdog event types, ready for the analyst to approve, reverse, or escalate.
The full loop
The four agents don't run in sequence — they share verdicts in real time. When Watchdog confidence and Decoy toolchain overlap, Containment fires without a human in the loop. When Playbook seals the packet, the analyst gets a one-click trail back to the original telemetry.
Continuous evidence chain
Every decision is hash-sealed and replayable — an auditor can re-verify the chain months later without re-running the analysis.
Mean time-to-contain under one second
Median measured across regulated tenants (HIPAA · PCI · DORA) for the last 30 days.
Reversible, never silent
Containment never deletes state it can't restore. The analyst can rewind the boundary or escalate — the agent never will on its own.
Loop trace
sample · replayable▸ every node = one agent verdict · every edge = verdict share · sealed audit-trail ready
▸ watch the loop run · on your telemetry
Thirty minutes. A sample stream. Watchdog agents scoring it in front of you, a containment verdict landing in real time, and the sealed evidence packet the Playbook would hand to your analyst. NDA available; procurement not required.
▸ 30-min session · NDA on request · sample stream from your sector