SOC
Where every Core module lands
- Live, partial, and roadmap labeled honestly on the platform page.
- Detection, risk, compliance, and identity share the same incident.
- Click a module, then come back to the operator board.
Core module 02 · LIVE
Cascading windows that assemble the full intrusion story.
W15, W60, and W24 correlation windows stitch burst recon, lateral movement, and slow APT dwell into one indigenous SIEM timeline — not a pile of unrelated alerts.
What it delivers
Live in Core today.
W15 burst correlation for scanning and brute force
W60 lateral movement and engineering pivots
W24 slow APT dwell and C2 staging
MITRE ATT&CK + ICS tactic coverage
How it works
From signal to sealed evidence.
01
Capability 1
W15 burst correlation for scanning and brute force
02
Capability 2
W60 lateral movement and engineering pivots
03
Capability 3
W24 slow APT dwell and C2 staging
04
Capability 4
MITRE ATT&CK + ICS tactic coverage
Playbooks
SOAR module in the workspace
- Run from the incident, not from a disconnected automation island.
- OT guardrails stay in the path.
- YAML for teams who version playbooks.
Key capabilities
Built for regulated IT/OT estates.
Signal sources
What feeds this module.
Kill-Chain Detection
Cascading W15 (15 min) / W60 (1 hr) / W24 (24 hr) correlation windows.
Kafka event pipeline
Ingest, normalize, enrich, detect, and respond on shared topics.
Edge & connectors
Passive OT capture plus syslog, HEC, and cloud telemetry.
Evidence vault
Detections and decisions hash-chained for auditors.
UEBA
User and entity behavior
- Anomaly signals join the same kill chain as OT protocol events.
- Useful when identity abuse starts the campaign in enterprise.
- Not a stand-alone UEBA SKU.
Proof points
Measured in the lab — not marketing adjectives.
LIVE
Module maturity
2
Core module number
6/6
Lab attack scenarios
62
Core microservices
Lab-validated metrics. Proof of Value results may vary.
Explore platform
Related capabilities.
Full platform menu
Every plane and module in one stack.
Platform overview
One platform, two planes — Core control plane and Edge collector for converged IT/OT.
Core control plane
Kafka-backed indigenous SIEM/SOAR — ingest, detection, risk, compliance, and response.
Edge collector
Passive SPAN capture at the industrial DMZ — telemetry up only, no PLC agents.
OT-native capture
Modbus, DNP3, OPC-UA, and MQTT parsed natively at Purdue L3.
SIEM + SOAR
Indigenous global SIEM and Temporal-orchestrated SOAR with human approval gates.
Kill-chain detection
W15 / W60 / W24 cascading windows across MITRE ATT&CK and ICS tactics.
FAQ
Frequently asked questions.
Is Kill-Chain Detection available in the free trial?
The 7-day trial includes Core modules marked LIVE. PARTIAL modules are visible with honest maturity labels.
Does this page replace the platform overview?
No. Each module has its own URL so buyers can deep-link a capability without landing on a generic platform dump.
Where does this module sit in the stack?
Cascading W15 (15 min) / W60 (1 hr) / W24 (24 hr) correlation windows.
Try Kill-Chain Detection on your traffic.
A dedicated CyberDragon tenant on your own traffic — not a slide deck. See kill-chain cyber defense on your network.