Trust and safety
Speed is only worth having if you can check it. armor360 shows its working, keeps each customer’s data apart and leaves what happens next to your team.
The line a security review asks about first, drawn in one place. It is the same on every plan and in every deployment.
Run on-premises, the platform and its AI model sit inside your network beside your SIEM. With the cloud fallback switched off, alerts, the logs the agent reads and its findings stay there. Notifications and tickets go only to the channels you connect.
armor360 connects with a key you create in Elastic, so you decide what it can read. Investigations need read access to your alerts and logs. Adding log collection through Fleet and switching rules on need further privileges, which you can grant later or not at all.
A verdict is only worth having if a person can check it. Each one cites the log line, lookup or event behind each claim, and the investigation map shows every question the agent asked on the way, including the ones that led nowhere.
Single sign-on through Okta, Microsoft Entra ID or any OIDC provider, or a password with a second step. Sensitive changes ask for the password again.
Analysts review and decide on alerts. Administrators approve rule and collection changes, and an analyst who wants one asks an administrator.
Each customer’s alerts, findings, settings and connections are kept separate from every other customer’s, including the AI model each one uses.
Who approved what, and when, is recorded: verdict changes, rule changes, collection changes and each approved plan step.
A signed evidence bundle for a period: how its controls map, an extract of the audit trail and a snapshot of the settings, for one customer or the whole platform.
A customer who leaves can export everything held for them, then have it erased from every store, with a signed certificate saying what was erased.
It takes no response action: it never isolates machines, locks accounts or blocks traffic. It makes two kinds of change to your tools, each only after a person approves: adding missing log collection through Elastic Fleet, and switching detection rules on in Elastic. Switching a rule off needs two administrators.
No. When you correct a verdict, armor360 remembers the correction for your later investigations, and that memory is kept with your data, apart from other customers’.
The investigation itself needs no cloud service when it runs on-premises with the fallback off: the model, the platform and your logs are all inside your network. Threat-intelligence lookups and notifications to outside services need their own connections, and each of those is optional.
You can export everything armor360 holds for you, then have it erased from every store. You get a signed certificate listing each store and what happened to it. Where a store cannot delete on request and instead lets data expire, the certificate says so in those words.
A signed evidence bundle for the period they ask about: how armor360’s controls map, an extract of the audit trail and a snapshot of the settings. It does not make you compliant on its own; it gives them a clear record of how alerts were handled and who decided.
Start a free pilot on your own alerts, or put in your own numbers first.