The four agents, explained
A field guide to the Watchdog, Decoy, Containment, and Playbook agents — what each one does, what your analysts see, and what they never do.
Threxen ships four agent families that share verdicts on a single telemetry plane. They do not hand off and forget — they cross-corroborate in real time and only escalate when their confidences overlap.
Watchdog is the scout. It scores every ingest event against attacker behaviours — adversarial-AI prompt patterns, lateral Kerberos abuse, OAuth refresh-token replay, supply-chain manifest drift — and surfaces a verdict within a second of the first suspicious signal. Decoy is the trap. It lays high-fidelity decoys (documents, SaaS endpoints, kubeconfigs) and live-poisons adversary tooling the moment it touches one. Containment is the muscle. Confirmed compromises trigger host isolation, session revocation, and tunnel teardown in under one second, and every action is reversibly recorded. Playbook is the seal. It binds every verdict that lands to the customer’s policy packs and emits a hash-chained evidence packet a Tier-2 analyst — or an external auditor — can sign off on without re-running the analysis.
None of these agents is allowed to be silent. Containment never deletes state it cannot restore; Playbook never invents findings at handoff. Reversal is a first-class action — the analyst can rewind the boundary if the decision was wrong, and the agent never will on its own.