What we watch

Telemetry from your endpoints, network, identity providers and cloud workloads streams to our CyberSOC over HTTPS. Noise is dropped at your edge before it ever leaves. One perimeter firewall we onboarded was producing millions of flow records a day on its own.

• Endpoints Workstations, servers, EDR agents
• Network Firewalls, proxies, DNS
• Identity providers SSO, directory, MFA
• Cloud workloads IaaS, SaaS audit logs, containers

Filtered at your edge

Security events, detections and alerts cross the wire. Package-manager chatter and raw firewall flow logs are dropped before they leave your network.

PROVINTELL CyberSOC

Events arrive over HTTPS and land silently. No email, no notification, and a 24-hour deduplication window, so a brief outage on our end loses nothing.

How we connect to your environment

Onboarding takes one of two shapes, and which one you get depends on what you already own rather than on what we would prefer to sell you.

If you already run a SIEM, you keep it. We read processed logs from it over TLS and change nothing about how your team uses it day to day. Your existing correlation rules, dashboards and retention policy stay exactly where they are. Our forwarder is additive: if it stops, it buffers locally and your own pipeline carries on without noticing.

If you have no SIEM, you do not need to buy one. We deploy our Log Manager at your edge and collect from endpoints, network and cloud ourselves. Noise is dropped before it leaves your network, so package-manager chatter and raw firewall flow records never cross the wire. One perimeter firewall we onboarded was producing millions of flow records a day on its own.

Both paths land in the CodeRed AI Data Lake, and that is the point of the fork. Events arrive normalised, deduplicated and stamped in UTC, so one query answers across log formats that would otherwise need three. Nothing downstream knows or cares which path a customer came in on, which means the detection content, the correlation rules and the analyst workflow are identical either way.

From the lake, three things happen in parallel. The original records are written to direct-attached storage, so an investigation can always go back to what was actually received rather than to an interpretation of it. Processed logs cross to the CyberLLM data processor on a cloud GPU service, which is the engine behind correlation, triage and the root-cause report. And the Threat Responder Hub reads the lake over an API, which is the screen your team actually works in.

Response closes the loop. When a case is released and an action is approved, containment leaves the Hub through the SOAR connector for your vendor and lands back in your environment. That return path runs through the eight gates further down this page, so nothing reaches your estate that has not cleared every one of them.

From alert to case

A correlation engine runs every minute over alerts that have not yet been attached to anything, evaluating a rule catalogue with 13 match types: the same detection firing on one agent, one source address appearing across many agents, frequency bursts inside a window, temporal sequences, one identity pivoting between hosts, asset pivots, crown-jewel escalation, and more.

Two design choices keep it honest at scale. Alert fetches interleave across customers in rotation, so a noisy tenant cannot starve a quiet one. And every alert is stamped once evaluated, matched or not, so nothing gets reprocessed and nothing blocks the head of the queue.

Before a case opens, deterministic gates run: known benign internal scanners never raise one, low-severity alerts with no MITRE phase are dropped, and a confidence floor applies with a penalty for single events.

How we improve detection with AI

CyberLLM writes the root-cause analysis on every correlated case. Your analyst gets who did what, which of your assets it touched, the attack path in order, and a verdict: real threat, false positive, benign activity, or needs investigation.

A model that writes prose can invent facts. We block that in five places, and each one fails closed.

1. 1

   Grounded by construction

   The prompt is assembled only from facts extracted from the case. Inventing an address, user, host, date or rule is forbidden outright.

   No fact in, no fact out

2. 2

   The reporting agent is never the suspect

   The log collector that reported an event is never treated as attacker or victim. That single rule kills the classic failure of blaming your monitoring infrastructure for the attack.

   Collector excluded by rule

3. 3

   Deterministic fact-linting

   Every address, date, time, hostname and username in the output is checked against the evidence by plain code, not by another model.

   A failed check forces a retry

4. 4

   Evidence-only fallback

   If generation still fails, a deterministic template renders the raw facts. Your analyst always gets something grounded.

   The pipeline never hard-fails

5. 5

   Forced indicator citation

   Indicators confirmed malicious by threat intelligence are injected as a structured block the model must cite.

   Known-bad cannot be dropped

Triage, and what happens when it is unsure

An AI triage router classifies each incoming incident as reject, release or review. High-confidence decisions act on their own. Anything below the confidence gate waits for one of our analysts.

Response, and the brakes on it

Containment runs through 37 vendor connectors across endpoint, identity and network: CrowdStrike, SentinelOne, Sophos, Kaspersky, BitDefender, Carbon Black, FortiGate, Palo Alto, Check Point, F5, SonicWall and the rest. You choose the autonomy level: manual, recommend-only, act-with-approval, or full-auto.

Run something that is not on that list and we build the connector for it. The adapter layer is ours, so adding a vendor means writing an adapter against their API, not waiting for a third party to support you. Tell us what you run during scoping and we will confirm what the actions look like before you sign anything.

Full-auto is the part we have engineered hardest, because the risk of automated response is not that it fails to fire. It is that it fires on the wrong thing.

Where approvals are required, two people are involved and self-approval is blocked. High-impact actions need a senior approver, and that requirement is recalculated at the moment of approval rather than when the request was raised. A request that grew in scope while it waited cannot slip past a junior.

A two-tier responder structure

Telemetry lands, the AI SOC Command Center triages and correlates it, and four teams pick up the work behind it. Level 1 threat responders own triage, investigation and playbook countermeasures. Level 2 IR specialists take escalations, red teaming and emerging threat hunting. A technology team keeps your integrations and dashboards healthy, and customer success owns onboarding, escalations and SLAs.

The loop at the bottom is the part that compounds. Every indicator of compromise and attack we confirm, plus each CODERED VTA advisory, becomes a threat hunting rule that goes back into detection. Your coverage grows from what we have already found on your estate.

Our analysts hunt in natural language through CodeRed GPT: ask for failed logins on an account across every host this week and it plans, queries and answers with evidence. It reads and never acts. Containment always goes through the gated workflow above.



Vulnerability management and prioritisation

• The scan Findings and CVSS across your estate
• CodeRed ASM What of it an attacker can reach from the internet
• Threat intelligence What is being exploited this month

One ranked queue

A medium-severity flaw on an internet-facing server that attackers are exploiting this month outranks a critical on an isolated internal system. Your team works down the list instead of down the CVSS column.

Security validation

We run breach and attack simulation against your estate to test whether your controls stop what they claim to stop. Your team finds the gaps in your defences before an attacker does.

What you get

• Continuous vulnerability assessment across your estate
• Prioritisation by exploitability and real exposure
• Breach and attack simulation against your controls
• Remediation tracking in the Threat Responder Hub

What you see

You work in the Threat Responder Hub: incidents enriched with MITRE ATT&CK tactics and techniques, a seven-stage kill chain rollup, severity counts, SLA compliance, detection trends, top affected hosts and users, attacker source countries, and mean time to respond.

Four scores snapshot daily and chart across 90 days: AEAS for exploitable exposure, SPS for operational pressure, PRS for predicted targeting, and DPS for how much of MITRE D3FEND you have active against the attacks you have already faced. Trend charts run on when an event happened rather than when we ingested it, so importing history does not distort the curve.

Ask SIMON answers questions about your own data inside the portal, in English or Bahasa Malaysia.

Ask for a quotation

Tell us where your assets sit and roughly how large your estate is, and we will come back with scope and pricing. Request an MXDR quotation.