# armor360

> armor360 is an AI SOC analyst. It takes the security alerts your tools already raise, investigates each one the way an analyst would and hands your team a plain verdict with the evidence behind it. Your people review the verdict and decide.

## Key facts

- What it does: collects new alerts, investigates each one by asking questions and answering them from your logs and threat intelligence, and ends with a verdict (real attack, suspicious, harmless or not sure), how sure it is and the evidence behind each claim. It orders the queue, joins related alerts into one campaign, runs threat hunts, drafts detection rules when asked and tests them on past alerts, finds machines that went quiet, and writes reports.
- What it never does: it takes no response action. It never isolates machines, locks accounts or blocks traffic. It makes two kinds of change, each only after a person approves: adding missing log collection through Elastic Fleet, and switching detection rules on in Elastic. Switching a rule off needs two administrators.
- Where it runs: fully on-premises, including armor360's own AI model, fine-tuned for security investigation, on your hardware; or hosted for you. With the cloud fallback switched off, alert data stays inside your network.
- Works with: Elastic Security (alerts, and the agent searches its logs); alerts from Splunk, Microsoft Sentinel, CrowdStrike Falcon and Microsoft Defender; findings to Slack, Microsoft Teams, PagerDuty, email, Jira, ServiceNow or a webhook; sign-on through Okta, Microsoft Entra ID or any OIDC provider. Through Elastic integrations it can read logs from 150 data sources.
- Who it is for: in-house security teams, managed security service providers (each customer kept apart, with its own tools, model and people), regulated organisations, and teams on Elastic Security.
- Pricing: by quote, sized to what you protect, with no charge per person. The pricing page has a calculator for staff time.
- Lab figures, not customer data: a median of 76 seconds to a verdict across lab runs with a clear queue; about $0.10 of compute per investigation on your own hardware.
- The name is written in lowercase: armor360.

## Platform

- [AI SOC platform: from alert to verdict](https://armor360.net/platform): How armor360 works: from a security alert to a verdict your team reviews, with the working shown.
- [SIEM and EDR integrations, Elastic first](https://armor360.net/integrations): armor360 takes alerts from Elastic, Splunk, Microsoft Sentinel, CrowdStrike and Defender, and sends findings to Jira, ServiceNow, Slack, Teams and PagerDuty.
- [On-premises AI model for security alerts](https://armor360.net/platform/ai-model): armor360 runs on its own AI model, fine-tuned by our team, and can run fully on-premises with the AI included.
- [Deploy an AI SOC analyst on-premises or hosted](https://armor360.net/deployment): Run armor360 inside your own environment with its own AI model on your hardware, or have it hosted for you. What set-up takes, and what it needs.
- [Trust and safety: people decide, AI investigates](https://armor360.net/trust): What armor360 does by itself, what waits for a person, what it never does, and how your data is kept, checked and erased.
- [Pricing and staff-time calculator](https://armor360.net/pricing): armor360 is priced by quote, sized to what you protect. Size a quote and work out the staff time on your own numbers.

## Product

- [AI alert triage: real attacks first](https://armor360.net/product/triage): armor360 collects every new alert, gives each a verdict and a reason, and puts real attacks at the top of the list.
- [AI alert investigation with cited evidence](https://armor360.net/product/investigation): armor360 investigates security alerts the way an analyst would and ends with a verdict your team can check.
- [Business context for security alerts](https://armor360.net/product/business-context): armor360 knows what each machine does for your company, so a verdict says what is at risk, not just which host.
- [Alert correlation into attack campaigns](https://armor360.net/product/campaigns): armor360 joins alerts that belong to the same attack into one campaign, told in order.
- [AI threat hunting on your own data](https://armor360.net/product/hunting): armor360 searches your stored security data for activity no rule has flagged yet.
- [Detection rules tested on past alerts](https://armor360.net/product/detections): armor360 shows how often a detection rule would have fired on your stored alerts before it goes live.
- [Log coverage: find machines that went quiet](https://armor360.net/product/coverage): armor360 finds machines that stopped sending logs and helps add the missing collection with Elastic Fleet.
- [Security investigation reports anyone can read](https://armor360.net/product/reports): armor360 turns investigations into reports in HTML, Word or PDF, and shows your ATT&CK coverage.

## Solutions

- [AI SOC analyst for in-house security teams](https://armor360.net/solutions/security-teams): armor360 takes the first look at each security alert, so a small in-house team spends its time on the decisions that need a person.
- [AI SOC for managed security providers (MSSP)](https://armor360.net/solutions/mssp): armor360 lets a managed security provider run the first look at alerts for many customers from one platform, with each customer kept separate.
- [On-premises AI SOC for regulated organisations](https://armor360.net/solutions/regulated): armor360 can run fully inside your own environment, its AI included, with every verdict backed by cited evidence and every approval on record.
- [Reduce alert fatigue with an AI first look](https://armor360.net/solutions/alert-fatigue): armor360 investigates each new security alert and puts the real attacks first, so your team reads verdicts instead of wading through noise.
- [AI SOC analyst for Elastic Security](https://armor360.net/solutions/elastic-security): armor360 collects alerts from Elastic Security, investigates them with searches of your Elastic data and helps close coverage gaps through Elastic Fleet.
- [Alerts investigated at night and on weekends](https://armor360.net/solutions/after-hours): armor360 investigates alerts that arrive out of hours, tells the on-call person about urgent findings and leaves the morning team finished work.

## Guides

- [Learning centre: SOC and AI security guides](https://armor360.net/learn): Guides to security operations: alert triage, investigation, detection, threat hunting and AI in the SOC.
- [What is an AI SOC? A plain guide](https://armor360.net/learn/what-is-an-ai-soc): An AI SOC gives an AI agent the first look at security alerts and hands people a verdict with its evidence. What it does, and what it leaves to people.
- [How an AI SOC compares with a traditional SOC](https://armor360.net/learn/ai-soc-vs-traditional-soc): A traditional SOC runs on tiers, shifts and handovers; an AI SOC puts an agent on the first look. Where each is strong, and how they fit together.
- [A practical guide to alert triage](https://armor360.net/learn/alert-triage-guide): Triage decides which alerts matter and in what order: the questions it answers, how to order the queue, state a verdict and its confidence, and escalate.
- [The hidden cost of false positives](https://armor360.net/learn/false-positives-cost): Alerts that turn out to be nothing still cost time and attention, and hide real attacks. Where the cost hides, and how to measure it in your own team.
- [Why alert fatigue happens and how to reduce it](https://armor360.net/learn/alert-fatigue): Alert fatigue is more alerts than people can give real attention to. Its usual causes, from noisy rules to night shifts, and practical ways to reduce it.
- [How to investigate a security alert](https://armor360.net/learn/how-to-investigate-a-security-alert): The questions an analyst works through to decide whether an alert is a real attack, and how to keep the evidence so others can check the verdict.
- [Alert correlation: joining alerts into one attack](https://armor360.net/learn/alert-correlation-and-campaigns): Why alerts read one at a time mislead, how to decide which alerts belong to the same attack, and what a campaign view should show the people reviewing it.
- [Threat hunting with hypotheses](https://armor360.net/learn/threat-hunting-hypotheses): How to turn an idea about attacker behaviour into a hunt you can run, the data each hunt needs, and how to read the results honestly.
- [Testing detection rules before they go live](https://armor360.net/learn/testing-detection-rules): How to check a new detection rule has the data it needs, how often it would fire on past data, and how to approve, tune and switch it off safely.
- [On-premises AI for security operations](https://armor360.net/learn/on-premises-ai-for-security): Why some organisations run their AI investigator inside their own environment, and what that means for data residency, regulation, running cost and hardware.
- [SOC metrics that matter](https://armor360.net/learn/soc-metrics-that-matter): Five measures that say whether a security operation is finding attacks and missing nothing important, and the habits that keep them honest.
- [How to triage Elastic Security alerts](https://armor360.net/learn/how-to-triage-elastic-security-alerts): A practical routine for triaging alerts in Elastic Security: what to read first, which fields and data to check, how to treat noisy rules and when to escalate.
- [Investigating suspicious Linux process activity](https://armor360.net/learn/investigating-suspicious-linux-activity): How to investigate suspicious process activity on Linux: reconnaissance commands, parent and child chains, cron jobs, beaconing and the logs you need.
- [Covering security alerts at night and weekends](https://armor360.net/learn/security-alerts-at-night-and-weekends): How to cover security alerts out of hours: on-call models, what should wake someone, runbooks, the morning handover and how an AI first look changes the night.
- [Running security operations with a small team](https://armor360.net/learn/security-operations-with-a-small-team): How a team of two to five people can run security operations: what to monitor first, tuning noise, outsourcing choices, safe automation and avoiding burnout.
- [AI SOC on-premises vs cloud: how to choose](https://armor360.net/learn/ai-soc-on-premises-vs-cloud): What leaves your network in a cloud AI SOC, what running one on-premises asks of you, and a checklist for choosing between them or mixing the two.
- [Alternatives to an MDR service, compared](https://armor360.net/learn/alternatives-to-an-mdr-service): What a managed detection and response service gives you, where buyers feel it falls short, and how in-house, co-managed, MSSP and AI SOC options compare.
- [SOAR vs AI SOC: what is the difference?](https://armor360.net/learn/soar-vs-ai-soc): SOAR follows playbooks written in advance; an AI SOC decides its next investigative step. Where each fits, what each costs to keep up, and how to use both.
- [How much does a SOC cost? A way to work it out](https://armor360.net/learn/how-much-does-a-soc-cost): A method for working out what a SOC costs: round-the-clock staffing, tools, hidden costs, and a worked example you can redo with your own numbers.
- [How to evaluate an AI SOC platform](https://armor360.net/learn/how-to-evaluate-an-ai-soc-platform): A buyer’s checklist for AI SOC platforms: accuracy on your own alerts, visible reasoning, honest confidence, data handling, pricing and demo red flags.
- [How to run an AI SOC pilot on your own alerts](https://armor360.net/learn/how-to-run-an-ai-soc-pilot): A step-by-step plan for piloting an AI SOC: scope, success criteria, known-answer alerts, reviewers, read-only access and what to measure honestly.
- [Can you trust an AI verdict on a security alert?](https://armor360.net/learn/can-you-trust-ai-security-verdicts): When an AI verdict on a security alert deserves trust: cited evidence, calibrated confidence, known failure modes, human review and a full audit trail.
- [AI in the SOC for regulated organisations](https://armor360.net/learn/ai-in-the-soc-for-regulated-organisations): How banks, healthcare, government and critical infrastructure can use AI in the SOC while keeping data at home, people accountable and evidence ready.
- [Alert triage for MSSPs across many customers](https://armor360.net/learn/alert-triage-for-mssps): How MSSPs can triage alerts across many customers: separate data, per-customer context, consistent verdicts, readable reports and analyst time.

## Blog

- [Blog: AI SOC product news and how it works](https://armor360.net/blog): Product news from armor360, and how it investigates security alerts.
- [How armor360 orders the alert queue](https://armor360.net/blog/how-armor360-orders-the-alert-queue): Why the order of an alert queue matters more than raw speed, and how armor360 sorts it: verdict first, then alert severity, with the unsure kept in view.
- [What our AI verdict labels mean](https://armor360.net/blog/what-our-verdict-labels-mean): Real attack, suspicious, harmless, authorised activity and unsure: what each armor360 verdict means, how to read its confidence and what a reviewer does next.
- [Why armor360 takes no response actions](https://armor360.net/blog/why-armor360-takes-no-response-actions): armor360 investigates and recommends but never isolates, blocks or disables anything. Here is why, what we do instead, and where automated response makes sense.
- [How reviewer corrections become memory](https://armor360.net/blog/how-corrections-become-memory): When a reviewer agrees with or changes an armor360 verdict and adds context, it is remembered for later investigations about the same company. Here is how.
- [Telling armor360 what your machines do](https://armor360.net/blog/telling-armor360-what-your-machines-do): At set-up you tell armor360 what each machine does, which business processes it serves and who to call. Here is why that matters and how to write it well.
- [What an on-premises AI SOC install looks like](https://armor360.net/blog/what-an-on-premises-install-looks-like): What runs where when armor360 is installed on your own hardware, what you provide, who maintains what, and when the hosted option is the better fit.
- [How to reduce noisy detection rules](https://armor360.net/blog/reducing-noisy-detection-rules): Find your noisiest detection rules, choose between an exception and a rewrite, test the change on past data, and know when switching a rule off is right.
- [MITRE ATT&CK coverage, explained](https://armor360.net/blog/mitre-attack-coverage-explained): What MITRE ATT&CK tactics and techniques are, what a coverage map tells you and what it hides, and how to rank gaps by the threats you actually face.
- [Detecting command-and-control beaconing](https://armor360.net/blog/detecting-beaconing): What command-and-control beaconing looks like in network and process data, how to tell it from updaters and agents, and an example from our own lab.
- [Living off the land on Linux: what to watch](https://armor360.net/blog/living-off-the-land-on-linux): How attackers use bash, curl, wget, python, cron and ssh on Linux, how to tell admin work from abuse, and which telemetry makes the difference.
- [Suspicious sign-in patterns and what to check](https://armor360.net/blog/suspicious-sign-in-patterns): Impossible travel, password spraying, MFA fatigue, risky new devices and interactive service accounts: how each shows in identity logs and how to check it.
- [Why machines stop sending logs, and what to do](https://armor360.net/blog/why-machines-stop-sending-logs): A machine that stops sending logs is a blind spot. The usual causes, how to find silent machines in your SIEM, and a simple routine to keep coverage honest.
- [How to write a SOC runbook analysts will use](https://armor360.net/blog/writing-a-soc-runbook): What a good SOC runbook holds, from trigger to who may act, how to keep it short and current, and a worked outline for a suspicious PowerShell alert.
- [SOC shift handover: a template that works](https://armor360.net/blog/soc-shift-handover): What gets lost between SOC shifts, a handover template you can copy, and how to track open investigations, pending approvals and the morning review.
- [SOC analyst burnout: causes and what helps](https://armor360.net/blog/analyst-burnout): Why SOC analysts burn out, the signs to watch for, and what team leads can change, with an honest look at what tools can and cannot fix.
- [SOC escalation paths that work in practice](https://armor360.net/blog/escalation-paths-that-work): How to build SOC escalation paths people follow: who to call for what, agreed severity levels, owners for key systems and contact lists kept current.
- [Onboarding a new SOC analyst: the first weeks](https://armor360.net/blog/onboarding-a-new-soc-analyst): A practical plan for a new SOC analyst’s first weeks: shadowing, reading real investigations, learning the business and taking on work in stages.
- [Tuning security alerts with the business](https://armor360.net/blog/tuning-alerts-with-the-business): How to tune noisy security alerts with IT and application owners: learn what normal looks like, record the context and get exceptions approved.
- [How AI agents investigate security alerts](https://armor360.net/blog/how-ai-agents-investigate-alerts): An AI agent investigates an alert by choosing its own queries, one step at a time. How that loop works, why each record is kept, and where it falls short.
- [Prompt injection in security logs and alerts](https://armor360.net/blog/prompt-injection-in-security-logs): Attackers write much of the text an AI analyst reads. How prompt injection reaches it through logs, files and emails, and the defences that hold up.
- [Why AI confidence scores matter in the SOC](https://armor360.net/blog/why-confidence-scores-matter): A confidence score only helps if 90% means right about nine times in ten. What calibration is, how reviewers should use it, and how to check it yourself.
- [Local vs hosted AI models for security work](https://armor360.net/blog/local-models-vs-hosted-models-for-security): Run an AI model on your own hardware or call a hosted one? The trade-offs for security teams in data, cost per alert, speed, control and specialisation.
- [How AI analysts get it wrong in the SOC](https://armor360.net/blog/ai-mistakes-in-the-soc): AI analysts go wrong in predictable ways: missing data, misread records, overconfidence and tidy but false stories. How cited evidence and review catch them.
- [Keeping people in charge of AI in security](https://armor360.net/blog/keeping-people-in-charge-of-ai-in-security): Human oversight of AI in security works when it is built in: clear lines of authority, recorded approvals, two-person rules and an audit trail you can read.
- [How to explain security to the board](https://armor360.net/blog/explaining-security-to-the-board): What boards really ask about security, how to turn alerts into business risk, and a one-page monthly report that leaves out the vanity numbers.
- [The business case for an AI SOC](https://armor360.net/blog/business-case-for-an-ai-soc): How to build the business case for an AI SOC: the hours spent on first looks, gaps at night, an illustrative calculation and how a pilot gives you real numbers.
- [Questions auditors ask about AI in security](https://armor360.net/blog/questions-auditors-ask-about-ai-in-security): The five questions auditors ask about AI in security operations, what a good answer looks like for each, and how to prepare the evidence before they arrive.
- [Security without a full SOC: where to start](https://armor360.net/blog/security-without-a-full-soc): For mid-sized firms with one or two security people: what to cover first, how MSSP and MDR services differ, and where an AI analyst helps and where it does not.
- [What to automate first in security operations](https://armor360.net/blog/what-to-automate-first-in-security-operations): Automate reading and enrichment first, and decisions and actions last. A step-by-step ladder for security automation, and why read-only is the safe start.
- [Twelve alerts, one attack: a lab story](https://armor360.net/blog/twelve-alerts-one-attack-from-our-lab): In our lab, 12 alerts from 5 rules turned out to be one attack on one Linux machine. How armor360 joined them into a single campaign, and why that matters.
- [Introducing armor360: an AI first look at alerts](https://armor360.net/blog/introducing-armor360): armor360 investigates security alerts from Elastic Security with AI and hands your team a verdict to review. Here is what it does, and what it leaves to people.
- [How armor360 investigates an alert, step by step](https://armor360.net/blog/how-an-investigation-works): We followed one alert from our test lab from its arrival to the verdict a person reviewed. These are the real screens.
- [Running an AI SOC analyst inside your own network](https://armor360.net/blog/running-inside-your-network): Alert data says a lot about a company. Here is what it takes to run armor360 so that data stays inside your environment.

## Company and resources

- [Product tour: an AI SOC analyst in two minutes](https://armor360.net/product-tour): A two-minute tour of armor360: triage, investigation, evidence, campaigns and detection rules, in the real console.
- [AI SOC analyst questions and answers](https://armor360.net/faq): What buyers ask about armor360: what it does, where data goes, which AI it uses, how it is priced and how it is run.
- [Videos: what an AI SOC analyst does](https://armor360.net/videos): Short videos on what armor360 does, for security teams, managed providers, finance and regulated organisations.
- [Run an AI SOC pilot on your own alerts](https://armor360.net/pilot): Try armor360 free on your own alerts, with your own team reviewing what it finds, before you decide. What a pilot needs, how it runs and what you measure.
- [AI SOC partner programme for MSSPs](https://armor360.net/partners): How managed security providers run armor360 for many customers: a space per customer, verdicts with evidence, reports customers can read, people deciding.
- [About: why we built an AI SOC analyst](https://armor360.net/about): Why we built armor360, an AI SOC analyst that shows its working and leaves decisions to people, and what we hold to.
- [Contact: ask for a demo or a quote](https://armor360.net/contact): Ask armor360 for a demo on your own alerts, a pilot, or a quote sized to what you protect.
- [AI SOC vs a traditional SOC, side by side](https://armor360.net/compare/traditional-soc): How an AI first look compares with a SOC run on tiers and shifts: who looks first, what analysts see, nights, growth, and who decides.
- [AI SOC analyst vs an MDR service](https://armor360.net/compare/mdr): How an AI analyst run by your own team compares with a managed detection and response service: data, visibility, decisions, response and cost.
- [Privacy notice for the armor360.net website](https://armor360.net/privacy): What armor360.net collects when you visit, what it does not, and how to ask about your data.
- [Terms of use for the armor360.net website](https://armor360.net/terms): The terms of using the armor360.net website.

## Optional

- [Every page in full](https://armor360.net/llms-full.txt): the words of each page on armor360.net, as plain text.