Detection engineering
620 detections · versioned like code
Curated rules mapped to ATT&CK, tested against replayed incidents before they ship. Every rule carries an owner, a changelog, and a false-positive budget.
[ security operations · 24×7 · deployed in 11 regions ]
Calm is asecurityposture.
Redoubt is the operations platform for teams who refuse to run their SOC on adrenaline. Every asset mapped, every alert enriched and ranked, every containment action one reviewed click — and every click logged.
- Median triage
- 38 s
- Coverage
- 24×7×365
- Events / day
- 4.1 B
[ 01 · capabilities ]
Built for the long watch.
A redoubt is the position you hold when everything else is contested. The platform is organised the same way: fewer alarms, better ground, and a clear line of sight on everything that moves.
Blast-radius graph
identity + endpoint + cloud, joined
The threat graph correlates who touched what, from where. When an alert fires, the neighbourhood is already drawn — you see reach before you see panic.
One-click containment
staged by machines, approved by humans
SOAR playbooks pre-stage the isolation, the credential revoke, the egress choke. An analyst reviews, clicks once, and the action lands with a full audit trail.
24×7 managed eyes
follow-the-sun · never a cold handoff
Our analysts work your queue around the clock with shift notes that read like flight logs. You wake up to closed cases, not open questions.
Evidence on demand
SOC 2 · ISO 27001 · one export
Every control your auditor asks about maps to events Redoubt already recorded. Evidence packs compile themselves — the audit becomes a download.
Forensics that hold up
chain-of-custody · 13-month retention
Disk and memory images captured at isolation time, hashed, sealed, and logged. When it matters legally, your timeline is already defensible.
[ 02 · the ops feed ]
Eight minutes of an ordinary shift.
This is what quiet competence looks like in a terminal: an impossible-travel login challenged and cleared, a credential dump blocked mid-read, a beaconing build runner choked at the egress — each one enriched, actioned, and written down.
- Enrichment before escalation. By the time a human sees a case, the graph, the intel match, and the related events are already attached.
- Actions carry names. Every containment step records who approved it and when — the audit trail writes itself in real time.
- Green is a result. The feed ends where every good shift ends: queue nominal, SLA green, handoff notes done.
06:41:02OK ingesttelemetry steady — 47.3k eps across 214 sensors
06:41:19WRNauthimpossible travel: j.reyes · SFO → WAW in 41m — step-up auth issued
06:41:20INFtriagecase #4816 opened · auto-enriched with 14 related events
06:41:33CRTedrlsass memory read blocked on fin-lt-044 (MITRE T1003.001)
06:41:34ACTcontainfin-lt-044 isolated from vlan-120 — approved by m.chen
06:41:58WRNdnsbeacon-like queries to nvx-cdn[.]top from ci-runner-07 · entropy 7.9
06:42:07INFintelnvx-cdn[.]top matches campaign "TinCup" (confidence 0.92)
06:42:11ACTsoarplaybook PB-114 "egress choke" staged — awaiting one-click approval
06:42:30WRNemail17 messages quarantined: lookalike domain heliagrid-sso[.]com
06:42:41INFiambreak-glass account audit clean — last use 194d ago
06:43:02WRNclouds3 policy drift: artifacts-prod grants public list — auto-reverted
06:43:15OK triagecase #4816 closed benign — travel confirmed via HR calendar
06:43:29INFvulnCVE-2026-2384 exposure: 3 of 1,207 assets · patch window 02:00
06:43:44OK edrfin-lt-044 image captured · 38 GB · chain-of-custody logged
06:44:01INFreportevidence pack compiled — SOC 2 CC7.2 / CC7.3 — 0 gaps
06:44:09OK ingestqueue depth nominal · p95 triage 38s · shift change in 16m
--:--:--···feedstream paused — static view
3 analysts on shiftqueue: 02p95 triage: 38sSLA: green
[ 03 · the numbers ]
Boring on purpose.
The best week in security is the one nobody writes a postmortem about. These are the numbers that keep it that way.
4.1Bevents parsed per dayacross 1,207 monitored assets
38smedian time-to-triagep95 holds under 2m 04s
12minmedian containmentfirst byte to isolation
99.99%console uptimetrailing twelve months
[ 04 · pricing ]
Priced like infrastructure.
Flat monthly rates, billed annually. No per-seat arithmetic, no surge pricing on the week you get popped — that is precisely when you should not be reading an invoice.
Outpost
for lean teams$1,450/mo
Full detection stack and the threat graph, run by your own responders.
- Up to 250 monitored assets
- All 620 detection packs
- Threat graph + case timeline
- 30-day hot retention
- Slack / PagerDuty escalation
Garrison
most deployed$4,900/mo
Everything in Outpost, plus our analysts holding the line with yours, around the clock.
- Up to 1,500 monitored assets
- 24×7 managed SOC coverage
- SOAR playbooks + one-click containment
- 13-month searchable retention
- Named analyst pod + shift notes
- SAML SSO / SCIM provisioning
Citadel
regulated & sovereignCustom
Private-cloud or on-prem control plane for environments where data cannot leave.
- Unlimited assets, dedicated cell
- Custom detection engineering
- Quarterly purple-team exercises
- Compliance evidence API
- Air-gapped deploy option
All tiers include onboarding with a detection engineer and a 60-day exit guarantee — your data leaves in open formats.
[ 05 · on the record ]
Teams that sleep.
“The 2 a.m. page reads differently when the graph already shows you blast radius. We stopped waking up the whole team to answer one question.”
“Our last audit took nine days of screenshot archaeology. This one took an afternoon and an export. The auditor asked who our evidence vendor was.”
“Redoubt’s analysts write shift notes like flight logs — what happened, what was ruled out, what to watch. I trust a handoff I can read.”
[ 06 · take a shift ]
Sit at the console.
The demo tenant is seeded with a live-fire scenario — a beaconing build runner, a phished laptop, one impossible-travel login. Triage it yourself, or watch the shift handle it.
- Read-only tenant · nothing you click touches production
- No credit card, no scanner, no sales call ambush
- Session data purged at the top of every hour