Eihwaz
EIHWAZ
POWERED BY HEXABOX

Outside in — from the customer's world and back

incident flows in lease response back
1/7A cyber incident is born in the customer's world2/7Fleet Command takes it in — attributed to one customer, inside its lease from the C-SOC owner3/7Seven specialists assess, sign and propose — the SOC correlates: one incident, one plan4/7The driver seat: one analyst in the loop — most of it runs autonomously5/7The CCAS gate asks who must say yes — T1 auto · T2 one · T3 named human · T4 two. This one needs a named human: the analyst approves6/7Action adapters carry the governed response back up into the customer's world7/7Threat stopped where it started — every step on the HexaRecord chain
GOVERNED RESPONSE · BACK INTO THE CUSTOMER'S WORLD THREAT STOPPED WHERE IT STARTED · ON THE RECORD THE CUSTOMER'S WORLD A company: its people, its IT, its cloud, its premises ● THREAT STOPPED · REPORTED TO THE CUSTOMER'S OWN SEAT People & employees mailboxes · accounts · devices IT environment endpoints · servers · identities · network Cloud services productivity · protection · SaaS Premises & sites offices · branches · tenants Phishing Ransomware ✓contained Account takeover Lateral movement Misconfiguration Exploited vulnerability Data exfiltration ● CYBER INCIDENTS ARE BORN HERE EVENTS · DETECTIONS · TELEMETRY ↓ FLEET COMMAND Takes it in — and may only act within its lease Ingress & connectors the customer's own sources, polled Tenant register every event attributed to one customer_id Door 2 delivery durable, idempotent hand-off on a ledger Lease check signed · scoped · expiring · else nothing FEDERATION COMMAND The C-SOC owner owns the fleets · issues Fleet Command's lease machine identity · tiered mandate · revocable at any time sees k-anonymous rollups only — never a customer's content LEASE THE INCIDENT, ATTRIBUTED AND LEASED ↓ SEVEN SPECIALISTS · ASSESS · SIGN · PROPOSE · NEVER EXECUTE G HexaGate EMAIL W HexaWard IDENTITY P HexaEndpoint ENDPOINTS N HexaNet NETWORK C HexaCloud CLOUD U HexaImmune VULNERABILITIES I HexaIntel THREAT INTEL EIHWAZ SOC · CORRELATES · ONE INCIDENT · ONE PLAN · ONE RESPONSE THE DRIVER SEAT One analyst in the loop · approves · overrides · manual one gesture away CCAS GATE · WHO MUST SAY YES BEFORE ANYTHING TOUCHES THE CUSTOMER'S WORLD T1 AUTO runs on its own, on the record T2 ONE CONFIRMS one analyst, one gesture T3 NAMED HUMAN the analyst must say yes T4 TWO INDEPENDENT dual approval, two keys ✓ THE ANALYST APPROVES ACTION ADAPTERS · ISOLATE HOST · BLOCK INDICATORS · QUARANTINE · DISABLE ACCOUNT HEXARECORD · what came in, who decided, what went back — one hash chain per customer, verifiable offline · the customer sees it in their own seat
one loop = one incident, 16 s · the gate holds the packet until the right human has said yes