The cornerstone

Stop clicking. <span class="grad">Start asking.</span>

The Familiar is one plain-English console for the whole SOC. The analyst asks a question; reasoning agents read your lake, narrate the open inquiries, run the enrichment, draft the detections, and propose the response. It commands every plane below, and it is held to the same law as every agent: it proposes, it never disposes.

Ask, do not click

One console. The whole SOC in plain English.

No query language to memorize, no flowchart to pre-build. You ask the way you would brief a senior analyst, and the Familiar does the legwork across the lake.

What is happening on host LON-4471 right now?
It pulls the open inquiry, the linked omens, and the entity timeline, then narrates the state in a sentence.
Enrich every indicator in this inquiry.
It runs the enrichment across your tools, attaches the evidence, and surfaces the multi-engine verdict spread.
Draft a detection for this technique.
It writes the detection from what the inquiry proved, maps it to MITRE ATT&CK, and hands it back for review.
How would we contain this account?
It proposes the response Spell with a reversible plan and a rationale, then routes the destructive step to a Seal.
From question to work

A question becomes an investigation, not a search box.

Legacy consoles answer with rows. The Familiar answers with work. It reads what you asked, decides which agents to send, gathers the context across your stack, and reasons to a conclusion you can read, with the evidence kept attached the whole way.

  • Reads the lake: omens, inquiries, and the entity timeline behind them.
  • Dispatches the right agents instead of running a fixed playbook.
  • Narrates the conclusion in plain English, evidence attached.
Ask
You ask in plain English
"Triage the new alerts on j.rivera and tell me if this is real."
Reason
Agents do the legwork
Context pulled across identity, endpoint, and email; six indicators enriched; the spread surfaced.
Narrate
The Familiar reports back
"Likely real. Contested verdict at 0.62. One account and one host implicated. Here is why."
Propose
It proposes the response
"Recommend disabling the account and isolating the host. Both reversible. Sending to a Seal for approval."
app.soarcery.ai/approvals
The Soarcery approvals queue: a response the Familiar proposed, waiting on an explicit human approve or reject at a Seal

Actual product. Demo data.

The boundary

It proposes. It never disposes.

The Familiar can read everything and recommend anything, but it lives under the same charter as every agent in the system. Enrichment, narration, and drafting run on their own. The moment a step is destructive or high-blast-radius, it stops at a Seal with its rationale and a reversible plan, and a human makes the call.

  • Read, enrich, narrate, and draft: autonomous, where the risk is low.
  • Anything destructive routes to a Seal for an explicit human approve or reject.
  • Every proposal carries its evidence and a reversible plan, logged to the inquiry.
The whole loop

One console on top of every plane.

The Familiar is the front of the house. Behind it: omens land in the lake, the stitcher builds the inquiry, three orders of watchers work it, and the Seal protects the blast radius.

The Familiar
Ask anything in plain English: query the lake, narrate an inquiry, propose a response. It oversees every plane below.
Proposes, never disposes
Plane 01
Keys
Your tools emit curated detections
omens
Plane 02
The Lake
Omens land, normalized and entity-indexed
by entity
Plane 03
Stitcher
Correlates omens that share an entity
builds
The case
Inquiry
One stitched, entity-linked timeline
worked by three orders of watchers
Detect
Attack Watchers

Read the omens, correlate the signals, and name what is happening. They open and build the inquiry.

Owns
Omens
MITRE
ATT&CK
Respond
Defend Watchers

Cast response spells to contain, evict, and restore, under gated authority. Destructive casts pause at a seal.

Owns
Spells
MITRE
D3FEND
Record
Scholar Watchers

Document the inquiry, collect the seals, and keep your ticketing in sync: Jira, ServiceNow, Resilient.

Owns
Scrolls
Record
& sync
Attack detects Defend responds Scholar records every step
Seals: propose and dispose
A watcher proposes; a human disposes. Every destructive or high-blast-radius cast stops here with its rationale and a reversible plan.
Human approves
on approve
Response cast
Contained, reversible, logged to the inquiry
Attack · Omens · ATT&CK
Defend · Spells · D3FEND
Scholar · Scrolls · Record and sync
Figure 1: the Soarcery loop. Omens in, sealed response out. The Familiar commands, the watchers act, the seal protects.
Stop clicking through consoles

Bring a question. Watch it work.

A 30-minute walkthrough on your real triage flow. Ask the Familiar about your own alerts and see the proposal land at a Seal.