Trace works through your SIEM alerts like a seasoned analyst: it connects events, checks them across every system and closes out the routine. Every verdict comes with evidence, and anything doubtful goes to a human.
per investigation, vs. 30–90 minutes by hand
correct verdicts on 30 BlueSec incidents
2 minutes per investigation, vs. 30–90 minutes by hand. 30 of 30 correct verdicts on 30 BlueSec incidents.
Start with what you already have.
Trace SOC
A tier-1 autopilot on top of your SIEM. It closes routine alerts on its own, with evidence, and hands disputed ones to an analyst.
Also R-Vision SIEM, KOMRAD, Ankey SIEM, Elastic and OpenSearch. Custom SIEM via API or event export.
Trace Watch
An AI on-call analyst through your insurer or MSSP: a verdict in minutes, help in the first minutes of an attack.
Trace AgentResearch
Reconstructs what your AI agent did and why: what data it read and where someone tried to lead it astray.
An alert arrives from your SIEM. Trace takes it from there, like a tier-1 analyst.
Demo screens (in Russian), investigation WH-WS-50. Steps auto-advance; click to pick one.
Trace doesn’t ask for your trust. Evidence sits next to every verdict, and where it couldn’t verify something, it says so. In all three editions.
Three outcomes, not two: when there’s not enough data or the verdict is disputed, a human makes the call.
Investigates every alert alongside your analysts, but closes nothing on its own.
Closes low-priority routine alerts by itself and hands disputed ones to an analyst.
Measured results on your own incidents. Then you decide.
The pilot is free
One month on your data. You get measured results on your own incidents. From you: one SOC’s data for the month and one analyst for two weeks.
On-premises, inside your perimeter, on open-weight models. Read-only: a human approves every action.
Write to us. We reply within a day.
info@trace-soc.ru@logachevnNikita Logachev, founder
Open the live demoDemo in Russian
It’s built for that. There are three outcomes, not two: when there’s not enough data or the verdict is disputed, the investigation goes to an analyst. Trace closes only low-priority routine alerts on its own, and an analyst spot-checks what it closed. High-priority alerts are always decided by a human. Every decision is logged with its evidence, so it can be reviewed and reopened.
Nowhere. Trace is deployed on-premises, on your hardware, and runs without cloud APIs. Personal data never leaves your perimeter. In your systems, Trace is read-only: it writes nothing, and a human approves every action.
It helps you meet security monitoring and incident response requirements, including Russian ones: FSTEC orders for critical information infrastructure and the Bank of Russia standard GOST R 57580.1.
Open-weight language models deployed inside your perimeter. Links between events are scored by an algorithm, not a neural network: how rare the coincidence is in your company’s history. One model writes the investigation, and a second model is required to argue against it.
We price it after the pilot, based on alert volume. By then you have measured results on your own incidents to base the decision on. The Trace SOC pilot is free.
SOAR runs playbooks that people wrote for it. Trace investigates: it gathers events across systems on its own, links them and explains its verdict. An AI assistant in a SIEM retells the alert. Trace attaches evidence to the verdict, says where it couldn’t verify, and never treats text inside the data as proof.
One SOC’s data for a month and one analyst for two weeks, with read-only access. Today Trace works with MaxPatrol-format data; we’ll connect another SIEM with a connector during the pilot. You get measured results on your own incidents.