The first twenty minutes of an investigation disappear
Asset, vulnerability, identity and file-integrity context resolving to the same identity removes the pivoting that consumes the opening of every investigation in a multi-tool stack.
SOC 2 Readiness
24/7 Security Monitoring
Canadian-Based SOC
GuardsArm Platform · Platform
XDR Command Center
Everything in one command center.
Analyst, administrator and client-portal views live in the same console. An analyst investigating one alert does not open six interfaces to gather context.
- Analyst + admin + client views
- Console-based rule tuning
- Per-tenant scoping
What is at stake
Cross-tool correlation does not disappear when nobody has time for it — it simply stops happening, silently, exactly when volume is highest.
New analysts become productive sooner
One interface to learn instead of six shortens onboarding and reduces how much capability walks out when an experienced analyst leaves.
A client portal that is itself a deliverable
For service providers, a customer-facing view scoped to their own tenant is something to sell and show, not a report assembled by hand each month.
Who carries this
The SOC lead day to day. For service providers the client portal is frequently what is demonstrated in the sales meeting.
The problem
A unified platform that needs six tabs is not unified
Most security stacks are assembled rather than designed. Endpoint came from one vendor, the SIEM from another, vulnerability management from a third, identity from a fourth, and each arrived with its own console, its own severity vocabulary and its own notion of what an asset is.
The cost is paid during triage, by the analyst, in the least forgiving conditions. They see an alert in one tool, look up the asset in a second, check its vulnerabilities in a third, correlate the identity activity in a fourth, and act in a fifth. That correlation is being done by a human, from memory, under time pressure— which means it is slow, inconsistent between analysts, and the first thing to go when volume rises.
It is also the step where a platform’s unification claim is really tested. A product suite that shares a vendor but not a console has moved the integration problem to procurement rather than solving it.
Cross-tool correlation does not disappear when nobody has time for it. It just stops happening.
The console areas
What is in the command center
Command Center
Overview, threat map, risk posture, tenant fleet and business-unit summary — the view that answers "what is happening right now" without drilling anywhere.
SOC Operations
Alerts inbox, investigations and cases, threat hunting, the MITRE ATT&CK view, event timeline and the Malware Center.
AI SOC Analyst
Overview, incident queue, alert explanations, approval center, knowledge base, and feedback and learning.
Identity and AI threat consoles
Dedicated ITDR and AIDR consoles, so identity and GenAI findings have their own working surface rather than being folded into generic alert noise.
Assets, agents and vulnerabilities
Inventory, agents, groups, software, network, profiles and telemetry, alongside CVEs by asset and remediation views.
Detection Engineering
Coverage, integrations and policies, source parsing, rule performance, custom detections and rule testing — so tuning is console work rather than a code deployment.
Compliance, file integrity and reports
Compliance posture, evidence and reports; file integrity changes and baseline; the report center with generated and scheduled reports.
Client Portal
A customer-facing view of their own dashboard, incidents, assets, threat map, vulnerabilities, compliance, service, support and reports — scoped to their tenant.
Administration
Users and roles, RBAC policies, API console, audit log and settings.
How it fits the platform
One console is the reason the unified-stack claim holds up operationally. Separate tools for each capability means manual correlation across interfaces, which is slow, inconsistent between analysts, and the first thing dropped when alert volume rises.
How it works
One investigation, without changing tools
The sequence below is the entire argument for a single console, expressed as the path an analyst takes through it.
The alert arrives in the inbox
Already carrying its severity band from the shared scale, its ATT&CK technique and tactic, and whatever threat-intelligence context was attached at detection time.
The asset resolves without a pivot
Inventory, agent status, installed software, open vulnerabilities and recent file integrity changes are all for the same asset identity. In a multi-tool stack this is where the first twenty minutes go.
The timeline supplies the sequence
Event timeline and the correlated incident show what happened either side of the alert — which is usually the question that decides whether this is an incident or a false positive.
The AI explanation is there if wanted
A plain-language explanation sits on the alert, produced by the on-premises AI service. It is context, not a verdict, and the alert reached the inbox whether or not the AI service ran.
Response fires from the same screen
Isolate, block, disable, kill or quarantine — through the approval center where a gate applies. The analyst does not change tools to act on what they just concluded.
The case carries the record
Investigations and cases hold the work, and the audit log holds who did what. Both feed the evidence library that the compliance module draws on.
By role
Which screens belong to whom
The console serves six distinct working patterns. Knowing which areas are yours is the fastest way to judge whether it fits your team.
The analyst on shift
- Alerts inbox
- Investigations & cases
- Threat hunting
- MITRE ATT&CK view
- Event timeline
- Malware Center
- AI incident queue
- Alert explanations
The detection engineer
- Coverage
- Integrations & policies
- Source parsing
- Rule performance
- Custom detections
- Custom rules
- Rule testing
The security lead
- Command Center overview
- Threat map
- Risk posture
- Tenant fleet
- Business-unit summary
- Report center
- Scheduled reports
The administrator
- Users & roles
- RBAC policies
- API console
- Audit log
- Settings
The asset owner
- Inventory
- Agents
- Groups
- Software
- Network
- Profiles
- Telemetry
The customer
- Client dashboard
- Incidents
- Assets
- Threat map
- Vulnerabilities
- Compliance
- Service
- Support
- Reports
Properties
Four things worth knowing about the console
Three audiences, one deployment
Analyst, administrator and client-portal views are the same console scoped differently. An MSP operator, their engineer and their customer are all served without standing up anything additional.
Console-based rule tuning
Detection Engineering is a console area, not a repository. Custom rules are authored, tested and measured for performance in the interface and apply to live telemetry immediately.
Per-tenant scoping
What a user sees is bounded by their tenant at the data layer, so the client portal is safe to hand to a customer. Scoping is not a view filter.
Where the screenshots come from
Every capability on these product pages is a console area. If an evaluation is going to turn on anything, it should turn on a walkthrough of this rather than on a feature list.
Background
Understand the concept first
Plain explainers on the underlying ideas, written for someone evaluating rather than buying.
Questions
Common questions
Is this one console or several?
One. Analyst, administrator and client-portal views live in the same XDR Command Center, which is what avoids the usual situation of an analyst opening six interfaces to gather context on one alert.
Can customers see their own data directly?
Yes, through the client portal: their dashboard, incidents, assets, threat map, vulnerabilities, compliance, service, support and reports — scoped to their tenant.
Can we tune detection from the console, or does it need engineering?
From the console. The detection engineering area covers coverage, integrations and policies, source parsers, rule performance, custom detections and rule testing, so tuning does not require a code deployment.
Works with
The modules next to this one
Every module runs in the same self-hosted stack and shares the same telemetry, severity model and response engine.
Flagship
AI SOC Analyst
An on-prem AI analyst that triages, correlates and explains — using a local LLM, so your data never leaves your network.
ExploreXDR — Detection & Correlation
Turn raw events into severity-graded, ATT&CK-mapped alerts — then connect them into real attacks.
ExploreMulti-Tenancy & MSP White-Label
One platform, many customers, complete isolation.
ExploreSee XDR Command Center running on your own infrastructure
We will walk through the console, the deployment model and what it takes to stand it up in your environment.
24/7 SOC Monitoring Available