Live log of the hub learning an indicator from one agent and broadcasting it to every other agent — so knowledge from one node protects the whole fleet.
Every node's events are polled into one hot store on the hub — search and timeline across the whole fleet at once (the SIEM hot store over the per-node tables). Retention & the ingest risk floor are set in Settings → Data, retention & archive.
Credentials the Analyst can use for actions. Values are encrypted at rest (AES‑256‑GCM), write‑only — never shown again, never sent to the model, never logged.
Third-party integrators feed signals into Antemure; the hub correlates them and the LLM reasons over them — so an identity attack (e.g. MFA fatigue against a credential in Okta) flows into the same detect → reason → remediate loop, remediating through the integration (suspend the user, revoke sessions) and the fleet (block the source IP).
Every incident, ATT&CK technique, indicator, host and the remediation that neutralized it — shared across the whole fleet. Agents query this graph before they remediate, reusing a proven playbook instead of re-deriving it. Hover a node for detail, click to focus its neighborhood, drag to rearrange, scroll to zoom.
Every entity attribute, command line and event payload is scrubbed of secrets & PII before it leaves a node for the reasoning gateway, and each node runs a hard token budget so reasoning cost can never run away.
The telemetry lifecycle, fleet-wide: how long the hot store keeps events / incidents / audit, whether events stream to your SIEM, and long-term archive to an S3 bucket (rehydrate on demand). Retention & archive are pushed to every node on its next poll. Secrets are write-only — a blank field keeps the stored value.
Re-run the first-run onboarding any time — secure the console, set the license & AI gateway key, and grab the fleet enrollment one-liner.
The hub validates its own cp_ license key against Access8 (fail-open). Set it here and the badge, the Analyst, and the gateway all pick it up immediately — no restart, no editing the service. It persists across restarts.
Which gateway model each layer uses, pushed to every node. The remediation agent does the hardest reasoning (investigate → find the root cause → act → verify) — keep it on a strong reasoning tier.
Use the managed Aura gateway, or point reasoning at any OpenAI-compatible endpoint (OpenAI, Azure OpenAI, a local vLLM / Ollama) with your own API key — pushed to every node. Keys are stored on the hub, sent only to nodes, and never shown here.
Every operator/admin action taken through this hub — approvals, denials, dispatches, license changes, autonomy toggles, and model/config changes. Append-only.
Connect your IdP + Directory Sync in WorkOS; users get roles from their AD groups. Secrets are stored encrypted (blank a secret field to keep the current value).
For when SSO/SCIM isn't used. Create accounts and assign roles directly. Adding the first account turns auth on.