Unified IOC + entity graph
Hashes, IPs, domains, URLs, email addresses, users, hosts, mutexes, registry keys — all first-class. Search any, see every event it ever appeared in.
Cyberange · TAW · Threat Analyst Workbench
Where have you seen this IOC before? In every case you have ever opened.
One workbench across threat intel, IR cases, and hunt notebooks. Type a hash, an IP, a domain, a TTP — and see every alert, case, and hunt where it surfaced, across the entire history of your SOC. Native MISP/STIX 2.1, native SIEM connectors, native case workflow.
The SOC problem
The IOC you are looking at right now probably crossed your perimeter eighteen months ago.
And the analyst who saw it then is on a different shift, a different team, or a different employer. The case notes are in a ticketing system. The IOC is on a threat-intel feed. The hunt that found it the first time is in someone's notebook. None of them are talking to each other.
01
IOC silos
Intel feeds in one tool. SIEM in a second. Case notes in a third. Hunt journals in a fourth. The IOC lives in all of them but no single view ties them together.
02
Context loss across shifts
Tier 1 hands off to Tier 2 hands off to the next-day team. Case-notes drift. The reason this IP was deprioritised yesterday gets lost — and re-prioritised tomorrow.
03
Manual enrichment overhead
Every IOC is a copy-paste tour of VirusTotal, OTX, AbuseIPDB, the SIEM, the case log, the hunt notes. Twelve tabs per alert. Burnout is built in.
How it fits
The one pane between your intel, your SIEM, and your incidents.
TAW ingests from upstream intel and your detection stack, normalises everything to a common IOC + entity model, and exposes a workbench UI to your analysts. Case state and hunt notes write back. SOAR and ticketing pick it up downstream.
Capabilities
What an analyst opens in the morning. What an IR lead closes at night.
Cross-event correlation
The same IOC in an alert today and an IR case eighteen months ago show up as one node in the graph. The dots connect themselves.
Case workflow built for IR
Tier 1 → Tier 2 → Tier 3 escalation states. Containment, eradication, recovery, lessons-learned phases. Audit-grade timeline for every change.
Hunt notebooks
Hypothesis-driven hunts with a notebook UI. Queries, results, screenshots, IOCs, conclusions — versioned, shareable, indexed forever.
Native intel ingestion
STIX 2.1, TAXII 2.1, MISP, RSS, commercial feeds. Bidirectional with MISP. Tag, score, and age intel without leaving the workbench.
Air-gapped or cloud
Deploy on-prem behind an air gap, in a private cloud, or as a managed service. Same workbench. Same connectors. Same model.
The pivot
One IOC. Every place it has lived.
Click an IOC in any alert, any case, any feed. TAW pivots to every event that ever touched it — across years of telemetry, every IR case opened against it, every hunt that hypothesised about it, every external intel record that ever scored it.
Sample workflow · Tier-2 analyst, 09:14
A new alert. An old IP. Five clicks instead of fifty.
The SIEM raises a beacon-like anomaly. The destination IP is one your SOC has never paid much attention to — except, it turns out, it has. Here is what the workflow looks like in TAW.
01
Click the IP in the alert
TAW resolves the IOC to its entity record and opens the pivot view. Without leaving the alert, you see every prior alert, case, hunt, and intel record that touched this address.
02
See the prior false-positive case
IR-2023-1027 closed as a false positive in April 2023. The case timeline is right there. The analyst who triaged it left a note: "low-volume, looks like a misconfigured monitoring agent."
03
See the validated hunt from last quarter
HUNT-Q2-2024-08 hypothesised the same address was a low-and-slow C2 beacon. The hunter found three other internal hosts beaconing to it. The hypothesis was confirmed but no case was opened — only a hunt journal.
04
See the external intel score escalation
MISP picked up the address from a partner six weeks ago. Score went from 40 to 75. The tags now read "C2 · beacon · APT-attributed."
05
Open a case with the chain attached
You promote the alert to an IR case. The previous case, the validated hunt, and the escalated intel score are linked automatically. Tier 3 inherits the full chain without you typing a single summary.
06
Trigger SOAR containment
TAW fires a SOAR playbook: isolate the host, query the EDR for every endpoint that has beaconed to the IP in the last 90 days, open a parallel hunt journal for the retro-sweep. Total wall-clock from alert to containment: four minutes.
Same workflow runs without changes for hashes, domains, URLs, mutexes, user accounts, or any other entity in your data.
What changes in the SOC
Triage time down. Context loss gone.
Mean time to triage
Per-alert context retrieval drops from minutes to seconds. The pivot is one click.
Cross-shift continuity
Case state and hunt notes are first-class. The next shift inherits the whole picture, not a summary.
Retro-sweep capacity
New intel scores trigger automatic retro-hunts. Threats sleeping in your logs surface themselves.
Audit + regulator readiness
Every IOC, every case, every escalation — timestamped, immutable, exportable on demand.
Speaks
- CERT-In TLP & advisory ingestion
- NCIIPC sector intel feeds
- STIX 2.1
- TAXII 2.1
- MISP
- MITRE ATT&CK
- SIGMA · YARA
- OpenAPI · Webhook
Practice
"Every IOC that ever crossed your perimeter is still in your logs. The question isn't whether you have it. The question is whether you can find it again, fast enough."
Put one IOC in the workbench. See the rest of the story.
Pilot deployment scoped to a single tenant. Connectors to your SIEM and intel feeds in week one. First retro-sweep on your data in week two.