Turn a security ticket into a living investigation. VIA auto-builds the incident as a link-analysis graph, plays it back in time, drills every node to the real evidence, and pulls what's missing — read-only. Then it hands you the blocklist, the work-note, and the story your MDR never told.
VIA’s edge isn’t the picture — it’s the join: indicators the ticket never held, recovered from the telemetry and root-cause your MDR never surfaced, with the delta rendered on the graph. Only possible when the same platform holds the ticket and the evidence.
Every ticket becomes a typed link-analysis map — accounts, infra, IPs, techniques, devices, blast radius — clustered by phase.
Every node opens the real record: worklog, attachments with SHA-256, and the exact telemetry rows behind the indicator.
Watch the attack unfold forward or backward with speed control — then record the sweep to a shareable video.
Attacker infrastructure on a live world map, with strikes animated victim→host in chronological order.
Toggle the reinvestigated graph over the original and diff it — every node and edge your collection surfaced lights up green, anything dropped in red. The join, made visible.
Pulls the IOCs the ticket text never held — straight from the collected logs, PCAPs and the root-cause doc — and puts them on the graph.
Geo, ASN, proxy/hosting flags and reputation from your own intel corpora — every indicator, on click.
Explicit, gated external reputation (VirusTotal · AbuseIPDB · OTX · abuse.ch) when — and only when — you say so.
Validate the message wasn’t deleted, then pull it exactly as-sent — headers, auth results, body — into the case.
Read-only endpoint triage (ls · ps · netstat · cat) over CrowdStrike RTR. No scripts, no changes — evidence only.
See what the victim saw — the malicious URL rendered in a cloud sandbox, screenshot + verdict, never on your host.
Search your Splunk live, or generate the exact SPL & NetWitness queries — built from real index names — for a manual pull.
An on-prem model reads the evidence and writes the analyst take — summary, IOCs, gaps, next steps. Nothing leaves your network.
Assessed against the SOC standard: what’s present, what’s missing, and the exact capability that collects each gap.
Blocklists, a mailbox-purge directive, and a paste-ready ServiceNow / Archer work-note. You action it — VIA never does.
New tickets are assembled the moment they land; reinvestigated ones turn green; the best get pinned as reference cases.
Every collection action lands in a tamper-evident, hash-chained log — operator, time, source, artifact SHA-256 — re-verified on read, corpus-wide. Court-ready by construction.
VIA is safe by construction. It observes, assembles and recommends — it never changes a customer’s environment unless you’re explicitly authorized to.