Detect. Contain. Roll it back.

Continuously collect your AWS resources into a queryable graph across accounts and regions. Filter in plain English, or walk relationships — an instance's security groups, a subnet's instances, a role's activity.

Every CloudTrail event, organized by the identity behind it. Timelines, per-actor profiles, and an activity graph turn investigation into a few clicks instead of a log grep.

Reusable detection templates (field match, threshold windows, sequences) become rules scoped to accounts, regions and filters. Rules evaluate the event stream in real time.

Chain the response as an ordered set of actions: notify, contain a principal, stop or terminate an instance, revoke a security-group ingress rule — driven from the catalog, targeting the event's own resource or graph-related ones.

Contain a compromised IAM user or role automatically when a rule fires, or with a single click from the alert email (link valid 24h, single-use). Cross-account containment via a scoped, least-privilege role.

Every action records the inverse needed to undo it. One unified Actions log shows what happened, who did it, and a Rollback button whenever an action is reversible — plus a full execution history for every rule run.

Every component deploys into your own AWS account via a single CloudFormation template. No data ever leaves your perimeter, and no vendor has access to your inventory, events or actions.

Optional. If you already run AWS GuardDuty, its findings flow in via EventBridge and can trigger the same rules and runbooks. Not required — inventory, events, automation and containment all work without it.