For SOC and security engineering
Investigate runtime threats
with the evidence in view.
A suspicious shell or credential read needs context. Primod brings observed process activity and workload identity into the investigation, with request context where available.
Start with what the sensor observed.
Review the activity that triggered a rule, its process ancestry, and the evidence that supported the finding. Distinguish a completed action from a failed attempt before deciding what it means.
Illustrative attack scenario · Product UI preview
Follow the sequence.
Inspect related alerts in an incident timeline. A shell launch followed by a token read and a connection attempt gives an analyst more to investigate than an isolated process name.
The timeline describes observed activity; it does not prove every step of an attack was captured.
Observed sequence
+0 ms
POST /api/upload
Observed+18 ms
Web process launches /bin/sh
Succeeded+43 ms
Process opens service-account token file
Succeeded+91 ms
Connection to 203.0.113.10:443
Failed
Same illustrative scenario as the homepage · Product UI preview
Give engineering a concrete starting point.
Identify the workload, namespace, and image associated with the finding. Available request and process context helps the team that owns the service investigate the same evidence.
Know the limits of the finding.
Review capture gaps and available coverage before reasoning from missing activity. A quiet alert stream is not proof that a workload is safe.
Questions teams ask.
- Can this identify the root cause automatically?
- The evidence supports investigation. It does not, by itself, prove an exploited CVE or every causal step.
- Can we use the evidence in incident review?
- Rule provenance, event outcomes, and workload context support review. Retention, export, and audit requirements should be confirmed for your deployment.