SOC Console Tour — VultSight

01

SOC Command Center

The whole security estate in real time.

Live KPIsMITRE heatmapThreat feed

VultSight Console · SOC

Critical Alerts

14

▲ 12% · 24h

High Alerts

63

▲ 6%

Total Alerts

412

▼ 4%

Active Cases

18

▲ 2

XDR Incidents

9

2 critical

MTTR

11m

▼ 3m

Threat Activity · 24h by severity

Critical High Med/Low

MITRE ATT&CK Coverage

Recon

Res.Dev

Init.Access

Execution

Persist

Priv.Esc

Def.Evas

Cred.Acc

Discovery

Lat.Move

Collect

C2

Exfil

Impact

Detection Sources

Endpoint38%

Network29%

Identity21%

Cloud12%

Live Threat Feed

C2 Beaconing · 10.0.1.4212s

Impossible Travel · j.okafor1m

LSASS access · WS-0423m

Port scan · 10.0.4.96m

Password spray · VPN9m

New IAM policy · aws-prod12m

S3 policy change · logs15m

01 · SOC Command Center

02

Alert Queue + AI Triage

Every alert auto-triaged — false positives close themselves.

TP / FP verdictsMITRE mappingAuto-close

VultSight Console · SOC

Severity	Alert	Source	Entity	Rule · MITRE	Time	Status	AI Triage
Critical	Credential dumping (LSASS)	Endpoint	WS-042	T1003.001	09:43	New	TP · 0.96
Critical	C2 Beaconing detected	Network	10.0.1.42	T1071.001	09:48	Triaging	TP · 0.93
High	Impossible travel sign-in	Identity	j.okafor	T1078	10:02	New	TP · 0.81
High	SMB lateral movement	Network	WS-042	T1021.002	09:55	New	TP · 0.79
High	Password spray on VPN	Identity	vpn-gw	T1110.003	08:30	Assigned	Review
Medium	Port scan from internal host	Network	10.0.4.9	T1046	08:12	New	Review
Medium	New IAM policy attached	Cloud	aws-prod	T1098	07:54	New	FP · 0.88
Medium	DNS tunneling suspected	Network	10.0.2.7	T1071.004	07:20	New	TP · 0.74
Low	S3 bucket policy modified	Cloud	logs-bkt	T1525	06:48	Closed	FP · 0.91
Low	Service account anomaly	Identity	svc-backup	T1078.004	06:10	Closed	FP · 0.85
Info	Sysmon process create burst	Endpoint	SRV-09	—	05:33	Suppressed	—

✨ AI auto-closed 37 false positives today Showing 11 of 412 · Page 1

03 · Alert Queue + AI Triage

03

Cases & ITSM

Native ticketing with SLA tracking and auto-escalation.

Case lifecycleSLA trackingAuto-escalation

VultSight Console · SOC

Open Cases & Tickets SLA-tracked

ID	Title	Sev	Status	Owner	SLA
CASE-…014	Multi-stage intrusion · WS-042	Crit	Investigating	J.Okafor	−12m
CASE-…013	Phishing wave · finance	High	Containing	A.Mensah	38m
CASE-…011	Impossible travel · j.okafor	High	Triaging	Unassigned	−4m
CASE-…009	Brute force · VPN gateway	Med	Open	R.Silva	2h
CASE-…007	S3 policy change · logs	Low	Verified	A.Mensah	Met
CASE-…006	DNS tunneling · 10.0.2.7	Med	Investigating	J.Okafor	1h 20m
CASE-…004	Service account anomaly	Low	Resolved	R.Silva	Met

18 open2 breachedAuto-escalation L1 → L2 → L3

CASE-20260617-014 Critical

● InvestigatingL3 · J. Okafor

SLA · resolution

Breached by 12m · escalated to L3

Tasks

✓Isolate WS-042done

✓Block C2 · 185.xdone

Revoke j.okafor tokensin progress

Forensic imagequeued

Timeline

Linked from INC-…000731m

Cases & ITSM

04

SOAR Playbooks

Drag-and-drop response orchestration with approval gates.

Visual flowsApproval gatesExecution log

VultSight Console · SOC

Visual Playbook drag-and-drop orchestration

Last Execution

Trigger matched✓ 0.1s

Condition: risk 94 ≥ 70✓

Endpoint isolated · WS-042✓ 2.4s

C2 IP blocked · 185.x✓ 1.1s

Approval · awaiting L2⏸

Create casequeued

Notify teamqueued

Post-action: linked alert → Contained, incident → Containing. Mean containment time: 3.6s.

05 · SOAR Playbook Orchestration

See the SOC console

About this tour

SOC Command Center

Alert Queue + AI Triage

Cases & ITSM

SOAR Playbooks