Alba is live
Autonomous investigation and threat hunting for multi-SIEM SOC and MSSP teams

Investigate every alert. Hunt what never fired one.
Your SIEM. Your LLM. No migration.

Point Alba at the alerts assigned to your team and it works them inside the stack you already run — pulling context, chasing every entity lead across the SIEM, weighing the evidence, and reaching a confidence-scored verdict. It then proposes a response, or carries one out within the limits each customer sets. And it doesn’t wait for alerts — Alba proactively hunts your environment with hypothesis-driven threat hunts, exposure and posture mapping, and dark-web monitoring, surfacing the threats that never tripped a rule.

Autonomy mode
Recommend · Approve · Auto-action
Audit trail
Every step recorded
Human oversight
Tunable per action
Tenant isolation
RBAC on every query
Response actions
Enabled per customer
Request a Pilot → See How It Works
alba analyst — alert #555833
alba > analyze 555833 --depth 1
 
[1/7] Fetching alert from case management...
[2/7] Extracting IOCs: 12 IPs, 3 domains, 2 hashes
[3/7] Enriching via threat intelligence (100+ feeds)...
     2 suspicious • 0 malicious
[4/7] History: Rule fired 47x, 94% FP rate (30d)
[5/7] SIEM depth=1: 14 queries → 10 follow-up
     Discovered: 4 hosts, 2 users, 6 IPs
[6/7] Memory: 3 similar past investigations found
[7/7] Generating analysis...
 
✓ Classification: True Positive — HIGH confidence
   ▶ Isolating compromised endpoint via EDR...
✓ Endpoint isolated • Incident ticket created
✓ Posted to case management • Tagged • Indexed
   62.1s total • 24 SIEM queries • 3,156 tokens
Multi-tenant SOC Control Plane
Alba SOC Dashboard — multi-tenant overview
Threat Intelligence & Dark Web Monitoring
Alba Threat Intelligence — dark web entity graph
Tenant-scoped RBAC
Full audit logging
BYO data residency
GDPR-ready data flows
SOC 2 Type II in progress
<90s
Average investigation time
>98%
Classification accuracy
75
Investigation & response tools
100+
Threat intel feeds supported
0
Vendor lock-in required
Governed Autonomy

Automated where you allow it.
Held for a human where you don't.

Each customer decides how far Alba goes on its own — surface a recommendation, wait for sign-off, or act automatically — set per class of action. And nothing happens off the record: queries, enrichment, hunts, classifications, and responses all land in the audit trail.

01 · Autonomy Mode
Configurable autonomy
Recommend-only, approval-gated, or auto-action — selectable per action class and per customer tenant.
02 · Audit Trail
Every step logged
SIEM queries, enrichment results, classification reasoning, and response actions written to a tamper-evident audit log.
03 · Safety Gates
Five gates before any action
Classification, confidence threshold, alert age, allow/deny lists, and risk ceilings — an action runs only when all five clear.
04 · Tenant Isolation
RBAC at every query
Every query runs inside the requesting customer's boundary — scoped by tenant mapping, gated by role-based access control, and written to the audit log.
05 · Response Actions
Enabled per customer
Response capabilities are enabled per-customer. Above-ceiling actions escalate to a human instead of executing.
The Problem

Most AI SOC tools were built for
someone else's business model.

The category was built for enterprise SOCs with full-stack commitments. MSPs and MSSPs operating across mixed customer stacks have different constraints — and most platforms work against them.

  • ⚠

    Built for one stack at a time

    Most AI analysts are tightly coupled to a specific EDR, SIEM, or productivity-suite license. If your customers run mixed stacks, you're operating multiple platforms — or asking customers to migrate.

  • ⚠

    Pricing models built for enterprise SOCs

    Per-investigation, per-SCU, or platform-bundled pricing scales with alert volume — the opposite of what an MSP needs as customer count grows. Your margin shouldn't move when alert volume does.

  • ⚠

    Triage assistants, not investigators

    Many AI SOC products stop at real or not real. They don't pivot across the SIEM, follow entity trails, or close the response loop — that work still falls to your analysts.

  • ⚠

    Multi-tenancy as a services overlay

    Where MSP support exists, it's often a services wrapper around a single-tenant product. Onboarding tenant 47 becomes a project, not a config change.

  • ⚠

    The queue only holds what already fired

    A rule has to catch something before anyone looks at it. The valid credential bought on a leak market, the internet-facing asset with a known-exploited CVE, the actor staging quietly — none of it is in the queue. Hunting is supposed to close that gap, and it's the first thing dropped when the queue is full.

Six questions to ask any AI SOC vendor

1. Stack independence
Works with my customers' SIEMs and LLMs without forcing migration?
2. Depth of investigation
Multi-pass investigation, or stops at triage?
3. Response controls
Executes actions under policy gates, or recommends only?
4. Multi-tenancy
Multi-tenant by architecture, or services-wrapped?
5. Pricing structure
Pricing scales with my margin, or against it?
6. Proactive coverage
Hunting, exposure and dark web in the same loop — or only what fired?
Judged by how it operates. Not how it's sold.
Capabilities

Not a copilot.
A full autonomous analyst.

Alba doesn't wait for you to ask questions. It triages the queue, investigates alerts end-to-end, posts its analysis, and learns from the outcome. And it doesn't only work what fired — it hunts hypotheses, maps exposure, and watches the dark web for the threats that never raised an alert.

Layer 01 The Investigation Engine Ingest, enrich, investigate, classify.

Autonomous Alert Triage

Processes your entire alert queue automatically. Fetches context, extracts IOCs, enriches via your threat intelligence platform, runs SIEM queries, and classifies with confidence scores.

Multi-Pass SIEM Investigation

Doesn't stop at the first query. Discovers entities in SIEM results, follows trails across hosts, users, and IPs. Iterates until every lead is exhausted.

Threat Intelligence Enrichment

Every IOC enriched through your threat intelligence platform — OSINT, commercial, and proprietary feeds. MITRE ATT&CK mapping. Dark web monitoring. Per-IOC depth scoring.

EDR & Identity Context

Microsoft Defender integrated today; major EDRs adapter-ready. Pull endpoint telemetry, device timelines, and identity-context signals into the investigation flow.

Phishing Investigation in Chat

Phishing isn't a separate product — the chat agent, EDR, and TI tools handle suspect emails in the same investigation flow as everything else. Headers, URLs, attachments, sender reputation.

Layer 02 Threat Discovery Find what never fired an alert.

Hypothesis-Driven Threat Hunting

Alba doesn't wait for an alert to go hunting. Hypotheses are seeded from cross-customer intel, new vulnerabilities, and dark-web signals — then tested as real queries against live SIEM and EDR telemetry. Hunt tiers run on their own cadence: weekly, daily, hourly. Hunt in plain English, or let Alba run the board.

Adversarial Evidence Ledger

Every hunt follows one contract — gather, ledger, advocate, verdict. Evidence is recorded with direction (supports, refutes, neutral) and strength, and each hunt carries an explicit kill criterion written before it runs. A mandatory devil's-advocate pass argues the best innocent explanation, and a hypothesis that can't survive it never escalates. The model weighs evidence; deterministic code does the arithmetic and the state transitions.

Exposure & Posture Mapping

Attack surface and vulnerable assets ranked by real-world exploitability — EPSS scoring and known-exploited status, not raw severity. Posture checks across identity, email, and endpoint configuration land as remediation guidance in a tracked queue.

Dark Web Monitoring

Leaked credentials, brand and executive exposure, and threat-actor chatter — monitored continuously and entity-graphed, feeding hunt hypotheses and alert enrichment rather than sitting in a separate portal.

Threat Landscape Report

The executive roll-up: dark-web intelligence fused with the customer's own SIEM alert data and investigation history. Risk level, threat actors and campaigns, MITRE ATT&CK coverage, IOCs, alert correlation, a 30–90 day outlook, and P1/P2/P3 prioritized actions. Where a dark-web IOC also turns up in that customer's own alerts, the overlap is called out as active targeting.

Layer 03 Controls & Oversight Policy-gated execution. Full audit chain.

Alert-Specific Remediation

Every investigation produces a tailored response plan. Alba executes it through five safety gates (classification, confidence, age, allow/deny, risk ceiling) against an 18-action catalog spanning EDR, case management, and threat intelligence — or hands the plan to the analyst with one-click approval.

Automation Policies

Customer-tunable rules for the repeat patterns. JSON conditions, configurable actions (close, tag, comment, assign, escalate), full audit trail. Run unattended on the high-confidence long tail.

Full Transparency & Debug

Debug mode exposes every query Alba runs against your SIEM. Full audit trails. Structured logging with timing and cost metrics. You see exactly what Alba did and why.

Layer 04 Compounding Leverage Memory, search, ChatOps, the flywheel.

Investigation Memory

Alba remembers every investigation. False positive rates per detection rule. IOC prevalence across customers. Historical context that makes every new analysis smarter.

Cross-Customer TI Flywheel

Confirmed true-positive IOCs are pushed back into the AlbaCyber Threat Exchange with TLP marking, scoring, and provenance labels. Every confirmed TP your tenants see makes every other tenant smarter.

Detection Rule Auditing

Automatically audits every detection rule across your SIEM. Finds broken syntax, silent encoding failures, case sensitivity issues. Auto-generates corrected rules and validates them end-to-end.

Semantic Investigation Search

Search thousands of past investigations by meaning, not just keywords. "Have we seen this attack pattern before?" Answers in milliseconds, with cross-customer anonymization.

Interactive Chat & Slack Bot

Natural language interface via web UI or Slack with RBAC-gated tools. Real-time streaming. Ask "search for lateral movement in the last 24h" and watch Alba work.

How It Works

From alert to answer
in under 90 seconds.

Alba runs a 17-step investigation pipeline for every alert. Here's the path from raw alert to classified, contextualised outcome — followed by the loop Alba runs when nothing fired at all.

01

Ingest & Extract

Fetch alert from your case management platform. Parse alert context, source content, and detection query. Extract IOCs from text with junk filtering. Deduplicate.

Case mgmt connectors IOC Extraction Alert Pipeline
02

Enrich & Correlate

Every IOC is enriched through your threat intelligence platform. Cross-referenced against investigation history for prevalence. Detection rule exceptions are pre-analyzed for syntax bugs.

Threat Intelligence Historical Context Detection Analysis
03

Investigate (Multi-Pass)

Run alert-type-specific SIEM queries against your existing platform. Extract new entities from results. Follow the trail: discovered hosts, users, IPs feed follow-up queries. Repeat until exhausted or depth limit.

SIEM connectors Multi-Pass Depth Entity Trailing
04

Analyze & Classify

Full context sent to your chosen LLM for analysis. Executive summary, evidence chain, MITRE mapping, confidence score. If prior analysis exists, Alba states agreement or disagreement.

Any LLM Local or Cloud Swap at Runtime
05

Respond & Remediate

For confirmed threats: isolate hosts via your EDR, block IPs at the firewall, disable compromised accounts in your identity provider, create incidents in your ITSM. Each action is configurable: autonomous, approval-gated, or recommend-only.

Any EDR Any Identity Provider Any ITSM Playbooks
06

Remember & Improve

Post analysis to case management. Tag and close the alert. Store the outcome for future context. Index the investigation for semantic recall. Notify your team. The next investigation is already smarter.

Case Management Investigation Memory Semantic Index ChatOps
The Hunt Loop

When nothing fired,
Alba goes looking.

Threat Discovery runs on its own cadence — hunt tiers scheduled weekly, daily, or hourly — and every hunt follows the same four-phase contract. Running in production today.

H1

Hypothesize

Seeded from cross-customer intelligence, newly published vulnerabilities, dark-web signals, and the customer's own alert history. Each hunt is written down as a testable statement with an explicit kill criterion — the finding that would end it — agreed before any query runs.

Intel-Seeded Kill Criterion Scheduled Tiers
H2

Gather & Ledger

Real queries against live SIEM and EDR telemetry — not a summary of what the alert already said. Every result is entered in an evidence ledger with its direction (supports, refutes, neutral) and its strength. The model assesses the evidence; deterministic code does the arithmetic and the state transitions.

Any SIEM Any EDR Evidence Ledger
H3

Advocate the Other Side

A mandatory devil's-advocate pass builds the best innocent explanation for everything gathered — the admin script, the misconfigured backup job, the travelling user. A hypothesis that can't survive its own counter-argument doesn't escalate; it closes, with the reasoning recorded.

Devil's Advocate Innocent Explanation Recorded Reasoning
H4

Verdict & Roll-Up

What survives becomes a confidence-scored verdict with its evidence attached, handed into the same investigation and response path an alert takes — including policy-gated response. Findings roll up, alongside exposure and dark-web intelligence, into the customer's Threat Landscape Report.

Confidence-Scored Same Response Path Threat Landscape Report
How to Evaluate

Judge these tools by how they operate,
not by how they're marketed.

Six dimensions matter when an MSP or enterprise SOC is choosing what to put in front of a customer. Most platforms in this category were architected for a different buyer — here's how the archetypes fall out.

Platform-bundled copilots

AI assistants tightly coupled to a specific EDR or productivity-suite license. The copilot is a feature of the bigger platform purchase.

Standalone AI SOC analysts

Independent triage and investigation tools. Typically priced for the enterprise SOC; multi-tenancy is a services wrapper.

MDR with AI overlay

Service-led offerings that compete for the customer relationship rather than through it.

Evaluation dimension Platform-bundled
copilots		 Standalone
AI SOC analysts		 MDR with
AI overlay		 Alba
Stack independence
Works with any SIEM, any LLM, no platform lock-in		 ○ ◐ ○ ●
Depth of investigation
Multi-pass SIEM investigation, entity-trail following, full audit chain		 ◐ ◐ ◐ ●
Response controls
Policy-gated execution, configurable autonomy		 ◐ ○ ● ●
Multi-tenancy
Multi-tenant by architecture, not by services overlay		 ○ ◐ ○ ●
Proactive coverage
Hunting, exposure mapping and dark-web signal feeding the same investigation and response loop		 ◐ ◐ ◐ ●
Pricing structure
Predictable, scales with endpoints not alert volume		 ○ ○ ◐ ●
● Strong fit ◐ Partial ○ Weak / off-category
Built for MSSPs

One platform.
Every customer. Every SIEM.

Alba was built from day one as a multi-tenant SOC platform. Customer isolation isn't bolted on — it's the architecture.

  • ✓

    Customer-Scoped SIEM Queries

    Every query runs inside the requesting customer's boundary — scoped by tenant mapping, gated by role-based access control, and written to the audit log. Each SIEM query is validated against that customer's index patterns before it runs.

  • ✓

    Cross-Customer Intelligence (Anonymized)

    Investigation memory tracks IOC prevalence across all customers. Analysts see "IOC seen across 3 customers" — never names or details.

  • ✓

    Mixed SIEM Support

    Every customer on a different SIEM? No problem. One Alba instance handles all of them through unified query abstraction. No rip-and-replace required.

  • ✓

    RBAC Per Analyst, Per Customer

    Analysts only see customers they're assigned to. Admins see everything. Tool permissions are enforced at execution time, not the UI.

  • ✓

    Automatic Queue Processing

    Configure which customers get automated analysis. Alba processes the queue, restores the previous alert owner, and tags completion. Zero manual intervention.

  • ✓

    Per-Tenant Hunts & Landscape Reports

    Hunt tiers run per customer on their own cadence, scoped to that tenant's telemetry. The Threat Landscape Report — dark-web exposure, actors and campaigns, ATT&CK coverage, and correlation against that customer's own alerts — becomes a deliverable you can put in front of them without writing it.

Customer Tenants — Live
Customer Alpha — SIEM A 12 alerts/hr
Customer Bravo — SIEM B 8 alerts/hr
Customer Charlie — SIEM C 23 alerts/hr
Customer Delta — SIEM D 5 alerts/hr
Customer Echo — SIEM A 17 alerts/hr
● All tenants isolated • 65 alerts/hr processed • 94% auto-classified
Architecture

Open. Modular.
Swap anything.

Alba runs on the stack you already own. Every layer connects through plugin-based adapters, so your SIEM, EDR, ticketing and threat-intel tools stay exactly where they are — and swap freely if they ever change.

AI Engine
Local / Self-Hosted LLMs
GPU Inference Endpoints
Cloud AI Providers
Enterprise AI Platforms
Your SIEM
Your SIEM platform
Log & alert sources
Security event streams
Plugin-based adapters
Intelligence
Your Threat Intel Platform
Investigation Memory
Semantic Search Index
MITRE ATT&CK
Endpoint & Identity
Your EDR platform
Endpoint telemetry
Identity provider context
Plugin-based adapters
Case & Ticketing
Your ITSM platform
Case & workflow sync
Custom webhooks
REST API adapters
Channels
Web UI
Chat Bots (Slack / Teams)
REST / WebSocket API
Custom Interfaces
Pricing

Priced to come out ahead.
A flat per-endpoint fee, plus the AI it runs.

A small monthly fee per protected endpoint, plus a simple markup on the LLM usage Alba's investigation engine drives. Because Alba clears the queue your analysts can't, most teams spend less per resolved alert than they do today — even after the markup.

Self-Hosted

Your Infrastructure

Deploy Alba on your own hardware. Run local LLMs for complete data sovereignty. Nothing leaves your network.

  • Predictable per-endpoint pricing
  • All investigation & response tools
  • Threat Discovery — hunts, exposure & dark web
  • Investigation memory & semantic search
  • Multi-tenant MSSP support
  • Single-command deployment
  • Community support
Request a Pilot →
Managed

We Run It For You

Fully managed Alba deployment. We handle infrastructure, updates, and scaling. You handle investigations.

  • Everything in Self-Hosted
  • Cloud LLM providers included
  • Managed Threat Discovery & landscape reporting
  • Managed infrastructure
  • SLA-backed uptime
  • Priority support
  • Custom integrations
Request a Pilot →
Enterprise

Full Partnership

Custom deployment, dedicated support, and joint development of industry-specific capabilities.

  • Everything in Managed
  • Custom LLM fine-tuning
  • Industry threat reporting
  • Threat Landscape Report on an executive cadence
  • Dedicated account team
  • Custom tool development
  • On-site deployment option
Talk to Us →
Get Started

Run a proof of value.
Two weeks · one SIEM · three rules · a scorecard you sign off.

A two-week proof of value run against your own environment — one SIEM, three detection rules, and a scorecard you agree to before it starts. Prefer to see it run first? Take the demo.

Request a Pilot → Request a Demo