Platform / Capabilities / Atlas
The whole surface on one screen
The capability atlas
Thirty-six published families, arranged by the layer they belong to rather than alphabetically. Filtering dims the map instead of rebuilding it, so the shape of the estate stays visible while you narrow it. Select anything to read what it is and how it is charged.
Find
Narrow
36 of 36 in view
Layer 1 · everything that happenedLayer 1 · everything that happenedLayer 1 · everything that happenedLayer 1 · everything that happenedLayer 1 · everything that happenedLayer 1 · everything that happenedLayer 1 · everything that happenedLayer 1 · everything that happenedLayer 2 · making sense of itLayer 2 · making sense of itLayer 2 · making sense of itLayer 2 · making sense of itLayer 2 · making sense of itLayer 2 · making sense of itLayer 2 · making sense of itLayer 2 · making sense of itLayer 2 · making sense of itLayer 2 · making sense of itLayer 3 · doing somethingLayer 3 · doing somethingLayer 3 · doing somethingLayer 3 · doing somethingLayer 3 · doing somethingLayer 3 · doing somethingLayer 3 · doing somethingLayer 3 · doing somethingLayer 3 · doing somethingLayer 4 · who, and may theyLayer 4 · who, and may theyLayer 4 · who, and may theyLayer 4 · who, and may theyLayer 4 · who, and may theyLayer 4 · who, and may theyLayer 4 · who, and may theyLayer 4 · who, and may theyLayer 4 · who, and may they
The agentIntegrationsEvent store and searchRetention and legal holdContinuous exportSource health and gapsComposed report deliveryEncrypted DNS resolverDetection libraryBehavioural baselinesThe provenance graphHunting and free queryDetection authoring and tuningCoverage against known techniqueEntity registry and aliasesVulnerability reachabilityMemory and disk forensicsDetonation sandboxThe approval gateContainment and isolationPlaybooks and automationCase managementCanary, verify and rollbackRecovery orchestrationEmergency stopVirtual patchingDeception and honeytokensAuthentication and step-upEnterprise sign-on and provisioningPrivileged access and sessionsNon-human identity inventoryPolicy declaration and assuranceCompartments and need-to-knowReports and evidence exportData classification and protectionConsumer rights desk
One program doing the work several products used to install separately — collection, enforcement and local policy.Anything that emits a signal becomes the same kind of event. Every source is listed in the integration catalogue.Sealed, timestamped events with a query surface over them. Bounded scans say when they stopped.How long events are kept, and how a hold overrides that for a named investigation.A stream of canonical events to a collector you nominate. Bounded by a policy you can read.Which sources are reporting, which stopped, and which never started — three different states.Scheduled reports to named recipients, bounded by an egress policy you can inspect.A resolver that answers over encrypted transports and blocks known-bad names at the point of asking.Rules with their logic, their technique mapping and their tests published rather than hidden.What normal looks like for one machine or person, learned from their own history rather than a global average.Events joined by what caused what, so a moment arrives with its lead-up and aftermath attached.Ask in plain language or write the query yourself; either way the compiled plan is shown back to you.Write, version and tune detection content without editing the platform.What you can and cannot currently detect, counted honestly — including what nothing measures.One identifier, every other name the same thing is known by, and who held an address at a given moment.Findings ranked by whether anything can actually reach them, which is what makes a queue defensible.Deeper collection from one machine when an investigation needs more than the event stream.Run a suspicious file somewhere it cannot matter, and keep what it did as evidence.The single place every world-changing action passes, and the single place to ask why one happened.Cutting a machine off while keeping your own access to it. Reversible, and held by default on important tiers.Sequences of actions that still each cross the gate individually. There is no path that skips it.Run an incident with its evidence attached, and export it for someone who has no access here.One machine first, then a check, then the rest — and an automatic rollback when the check fails.Getting back to a known state after an incident, in an order somebody decided in advance.Halts the whole automation plane rather than one action. Sits beside the queue, because that is where you will be.Blocking the path to a vulnerability at the edge while the real fix is scheduled.Things that have no reason to be touched, so touching them is a signal with almost no false positives.Proving who you are, and proving it again at the moment of a consequential act.Reads from the directory you already have rather than asking you to migrate to ours.Elevated access that is requested, approved by a second person, time-bounded and recorded.The service accounts and keys nobody remembers creating, and what each of them can still reach.Say what the estate should be, then see per machine whether it is — including where nothing could judge.Material only named holders may read, with a request path a second person approves.Narrative reports where every claim carries a link to the record that proves it.What counts as personal or sensitive in your estate, and what may leave which machine.Handling a person’s request about their own data, with the erasure actually reaching everywhere it exists.
Charged
includedincludedraw volume ingested per dayraw volume ingested per dayincludedincludedincludedincludedincludedincludedincludedincludedincludedincludedincludedincludedincludedincludedincludedincludedincludedincludedincludedincludedincludedincludedincludedincludedincludedincludedincludedincludedincludedincludedincludedincluded
Settled
stablestablestablestablestablestablestablepreviewstablestablestablestablestablestablepreviewstablepreviewpreviewstablestablestablestablestablepreviewstablepreviewpreviewstablestablestablestablepreviewpreviewstablestablepreview
Applies to
machinetenanttenanttenanttenanttenanttenantplatformtenanttenanttenanttenanttenanttenanttenanttenanttenanttenanttenanttenanttenanttenanttenanttenanttenanttenanttenanttenanttenanttenanttenanttenanttenanttenanttenanttenant
How to read the map
A dashed tile is in preview: licensed and supported, but the shape of its interface may still change. A clay outline is metered — there is exactly one meter on the platform line, raw volume ingested per day. Everything else has no mechanism by which it could bill.
What the map leaves out
Thirty-six families here stand for eighty-eight capabilities; the remainder are variations within these families and ship listed in the product. The map also says nothing about what a given organisation holds — that depends on its licence, and the console answers it for the organisation you are signed into.