Case-first · Enrichment before agents · Approve ≠ execute
Detections that prove they got quieter
Human-gated rule changes with measured false-positive drop. Enrichment and risk attach before agents reason. Containment stays two-tier HITL — Approve is not Execute.
Enterprise teams across hiring, manufacturing, cloud, and fintech rely on Vigil Eye for proactive security operations.
Our strategic partner extends Vigil Eye reach through enterprise sales, channel development, and market activation.
Platform differentiators
Beyond the governed agent pipeline — Ask AI with your choice of cloud or local LLM, alert anonymization at the model boundary, closed-loop detection, proactive hunt, and a knowledge base that compounds with every shift.
Analysts query the SIEM in plain English. Admins pick the Ask AI model in-console — cloud (Gemini, Claude, OpenAI) or local (Ollama, vLLM) — without changing the response-engine agents. Containment stays propose-only under HITL.
In-panel provider switch · sealed keys · Test connection · vLLM / Ollama ready
Before case context reaches third-party or local LLMs, client identifiers (IP, host, user) can be tokenized at the runtime boundary and restored for humans and execution — so model calls never need raw customer identifiers.
Per-case token map · agent-boundary tokenize/restore · operator console sees real values
Recurring false positives become concrete rule changes. Operators review the proposal; validated apply includes rollback if the ruleset fails.
Human-gated apply · FP-reduction math · effectiveness ledger
Scheduled hunts target MITRE coverage gaps and surface operator-ready reports in Threat Lens — threats that never tripped a rule.
6-hour cadence · MITRE-gap focus · Threat Lens reports
Prior analyst verdicts and approved tuning notes inject into new cases automatically — so shift changes do not erase SOC expertise.
Full-text search · auto-inject on ingest · admin browser
Agentic SOC · Human ownership
Agents accelerate the case — narrative, evidence, and plans. L1–L3 decides who owns it, when it escalates, and when it closes, with SLA pressure visible on the Investigations queue so work does not vanish between shifts.
First-line analysts claim the agent-prepared case, acknowledge within SLA, and confirm the initial narrative before the queue ages.
Self-assign · ack SLA
Escalated cases get deeper human pivots on top of agent evidence packs — with a clear ownership trail on every handoff.
Escalate · assignment trail
Senior ownership drives verdict and close on the agent-built record — merge when needed; SLA breaches stay visible until resolved.
Verdict close · merge · SLA visible
Differentiator · Closed-loop detection
The fame wedge: detections that prove they got quieter — with humans on the apply gate and an effectiveness ledger after the change ships.
Rolling false-positive rates flag noisy rules before analysts drown in repeats.
FP pattern detection
Detection engineering drafts a concrete rule change with expected FP-reduction math.
Human-reviewed proposal
Operators Approve; validated apply writes the ruleset and rolls back if validation fails.
Approve ≠ auto-deploy
Post-apply effectiveness tracking records whether false-positive rates actually fell.
Effectiveness ledger
Containment stays separate: agents propose, Tier-1 approves, Tier-2 executes — under the same policy allowlist. Ask AI proposals follow that path too.
Shipped capabilities
Threat intel (including KEV and EPSS), behavioral baselines, context, and a composite risk score attach on ingest — then a governed agent pipeline, Ask AI with selectable LLM providers (including local vLLM), optional alert anonymization, and closed-loop detection engineering advance cases under human approval gates.
Reputation feeds plus CISA KEV and FIRST EPSS enrich entities on ingest — before any agent reasons.
Rolling 30-day alert-frequency baselines flag unusual agents, IPs, and users with z-score signals.
A 0–100 score with explainable boosters — TI, anomaly, off-hours, asset tier, KEV, and EPSS.
Asset tier, privileged identity, historical sightings, and time-of-day context attach to every case.
Approve plan is not execute. Policy guardrails veto dangerous actions before containment runs.
Ask AI can propose block, isolate, and related actions; Approve & run re-checks policy before execution.
Admins select Gemini, Claude, OpenAI, Ollama, or vLLM for Ask AI only — including on-prem GPU serving — without retargeting triage agents.
Optional runtime tokenization of IP, host, and user before model context leaves the boundary; humans still see real values in the console.
Noisy rules surface as advisory proposals; post-apply measurement tracks whether false-positive rates actually drop.
Every case carries entities, timeline, enrichment, plans, approvals, and actions — audit-ready.
Dashboard, Executive, Triage, Investigations, Threat Lens, Attack Map, Detection Eng, Compliance, Reports, and Settings — plus Ask AI on every page.
Operators sign in through enterprise SSO. First login enrolls Google Authenticator; every later login requires the rotating one-time code.
Agents prepare the case; Investigations routes human ownership by tier — assign, acknowledge, escalate, merge, and close — with per-tier SLA and a full assignment trail.
Live geographic threat visualization for SOC and executive situational awareness.
Runs in your environment. Dead-letter queues and fail-open enrichment keep the pipeline moving.
Operator console
One console for triage, investigations with HITL, threat posture, Attack Map, Detection Eng, reporting — and Ask AI available on every page as a governed assistant.
Bridging the definitive gap between traditional operations and agentic intelligence.
"VIGIL TRIAGE turns SIEM/XDR alerts into operator-ready cases in seconds — not hours of manual log diving."
"Dead Letter Queues capture failed events for later replay so alerts are not silently dropped."
"Policy guardrails and human approval gates keep containment under operator control."
Fragmented Point Solutions vs Case Evidence
"Traditional SOCs juggle disconnected tools. Vigil Eye unifies alerts, entities, enrichment, and plans into one navigable case evidence pack for instant correlation."
Risk of Fatigue vs Deterministic Policy
"Humans make mistakes when tired. Vigil Eye uses code-based policy guardrails to veto dangerous actions before they execute — and separates plan approval from execution."
Manual Investigation vs Agentic SOC
"VIGIL TRIAGE analyzes, enriches, and scores alerts in seconds, replacing hours of manual log diving — then hands off to the rest of the agent pipeline."
Alert Fatigue vs Dead Letter Queues
"In high volume, humans ignore alerts. Vigil Eye's DLQ architecture captures failed events for later replay so nothing silently disappears."
Noise Pollution vs Context Before Escalation
"Correlation, threat intel, and behavioral baselines land before escalation — so analysts spend time on high-value cases instead of raw alert floods."
Shift Handovers vs Eternal Vigilance
"Attackers don't sleep. Neither does Vigil Eye. Continuous agentic coverage without shift handovers or holiday gaps — with humans still governing high-impact actions."
Human Context vs Structured Case Memory
"Teams lose context over time. Vigil Eye keeps structured case evidence and entity history so similar incidents stay correlated across shifts."
Static Skills vs Analyst Feedback Loop
"Traditional SOCs train annually. Vigil Eye captures analyst overrides and case outcomes into a structured feedback loop that improves future triage context."
Serial Work vs Coordinated Pipeline
"Humans work one task at a time. Vigil Eye orchestrates seven VIGIL specialists — triage, correlate, investigate, strategy, governance, response, and reporting — plus Ask AI, detection engineering, and threat hunt for the full SOC loop."
FAQ
Governance, residency, telemetry fit, and what a POC looks like — without a sales call.
No. Agents recommend and plan. High-impact containment requires two-tier human governance: Tier-1 approves the plan, Tier-2 executes. Ask AI proposals follow the same policy path — Approve & run, never auto-execute from chat.
