Platform
Intruex receives alerts your detection stack has already produced and turns them into decisions. This page is the whole mechanism, every step in order: what happens between an alert landing and a verdict you can put your name on.
We do not ingest your logs, store your telemetry, or write your detections. You keep the stack you have. We take what it produces and decide what it means.
That focus is the point. Your SIEM is good at detecting and your EDR is good at watching endpoints; neither was built to reason about what the result means. Intruex does one job and does it deeply. And where an organization has no detection layer yet, we stand it up first, then run the platform on top of it.
The pipeline
Nothing here is reconstructed after the fact. If a signal moved the verdict, it was stored when it arrived.
Alerts arrive from a native connector or over a REST endpoint. Splunk, Microsoft Sentinel, Defender for Endpoint, Intune and Acronis EDR have purpose-built integrations; anything that can POST JSON works through the generic path.
Everything is mapped to OCSF. This is what lets one specialist reason across a Splunk search result, a Sentinel incident and an EDR detection without a separate code path for each.
Indicators are resolved against external threat intelligence and against what this environment has seen before. The second half matters more than the first: public reputation on an internal IP tells you nothing.
The alert is routed by event type to a specialist analyst that owns that threat class. The specialist scores it, weighs the enrichment, and writes a disposition with a confidence value and plain-language reasoning.
Alerts that share indicators are grouped into one attack narrative with a kill-chain timeline. The correlation factors are written out per alert, so you can disagree with the grouping and see what drove it.
Response is a recommendation with an approval gate. No automated response action fires without a human. The confidence threshold that would allow one is per-organization and defaults to unset.
Two-tier investigation
Running a full agentic investigation on every alert would be slow and expensive, and most alerts do not need one. Running it on none of them is what leaves the hard cases sitting in a queue.
Every alert, every severity. Specialist heuristic scoring plus enrichment, concluding in one of five dispositions with a confidence value.
| Disposition | What it means |
|---|---|
| benign | Expected activity, explained |
| false positive | The rule fired on something that is not the thing |
| investigate | Not resolvable from the alert alone |
| escalate | A human should look now |
| true positive | Confirmed malicious |
Median AI triage time was 48 seconds in the July 2026 production month. measured
Triggered automatically on investigate and escalate. A tool-using agent does what a human analyst would do next, then writes up what it found.
The investigator decides which tools to reach for and how many times, iterating until it can conclude rather than running a fixed script. Every call is logged with its arguments and its result.
Deferred escalation: when the specialist is not sure, the alert is handed up rather than guessed at. A confident wrong answer is worse than an honest escalation.
What makes the second month better than the first
Facts about IPs, users, hosts, domains and hashes persist across alerts. That jump-host is still a jump host next week, and the analyst does not have to say so twice.
Confidence decays. A fact learned two months ago carries less weight than one learned yesterday, unless an analyst pins it.
Upload runbooks, policies and standard operating procedures. Retrieval is hybrid (semantic and keyword, re-ranked) and scoped strictly to your tenant.
The effect is that "we patch on Tuesdays with a signed vendor updater" stops being tribal knowledge and starts being an input to the verdict.
Open a conversation on any alert or narrative. The original analysis and heuristic scoring stay in context, so you are arguing with this decision rather than starting a new one.
Disagreements are part of the record too.
Scope
Intruex slots into the stack you already run rather than asking you to replace it. Your SIEM keeps detecting. Your EDR keeps its telemetry. Your automation keeps executing. We take the decision layer between them.
That is why a deployment is measured in days rather than quarters: nothing has to be migrated for it to start returning verdicts.
Hand it something from last week and read the reasoning. If the verdict is wrong, you will see exactly where it went wrong, which is the whole point.
