The Technology Behind HAWK
Security operations are often slowed by fragmented tools, disconnected telemetry, and manual handoffs between detection, investigation, and response.
Explore Octopus cAI, vTTAC, and HAWK’s patent-pending ClaimKit—the technologies behind HAWK’s approach to coordinated security operations. The sections below introduce each technology and link to its dedicated page for a closer look.
Connect. Enrich. Investigate. Decide. Contain.
How the HAWK Platform Fits Together
HAWK brings security telemetry and selected host evidence into a coordinated workflow for investigation, decision-making, and response.
The overview above shows how existing security tools, vTTAC, streaming analytics, and Octopus cAI + ClaimKit fit together. Explore the technology sections below for a closer look at each component.
Explore HAWK’s Core Technologies
HAWK combines purpose-built technologies that capture, normalize, enrich, analyze, investigate, orchestrate, and operationalize security evidence.
Octopus cAI — Autonomous Investigation
Octopus cAI reasons across multiple evidence streams, executes investigations autonomously and in parallel, and self-corrects as additional evidence becomes available.
vTTAC™ — Deep Host Evidence
vTTAC™ captures host telemetry and artifacts from servers and selected high-risk workstations, providing deeper contextual evidence to complement existing endpoint technologies.
HAWK.io ClaimKit — Evidence Intelligence
ClaimKit identifies, extracts, and cites the evidence relevant to an investigation, reducing unnecessary processing while improving the quality of information available for reasoning and decisions.
Supporting Platform Capabilities
HAWK Engine — Real-Time Streaming Analytics
High-velocity security telemetry is normalized, correlated, enriched, and analyzed as it streams, creating a continuously updated operational view across the environment.
Policy-Governed Orchestration — Coordinated Action
HAWK executes approved actions according to customer-defined policies and authorization boundaries while escalating higher-risk decisions when human authorization is required.
UX Streaming Dashboards — Operational Visibility
Real-time dashboards provide visibility into telemetry, investigations, decisions, response activity, and containment status for security operations and executive teams.
Extend the Security Investments Already in Place
Your existing security tools provide valuable signals. HAWK brings those signals into a coordinated security operation, connecting telemetry with investigation, decision-making, and response.
The goal is to help your team get more operational value from the technologies already deployed across your environment, without requiring a wholesale replacement of your security stack.
Automation Governed by Customer-Defined Authority
Machine-speed security operations do not require surrendering control.
HAWK operates within customer-defined policies, permissions, approval thresholds, and escalation boundaries. Approved actions can proceed automatically within that scope, while higher-risk decisions escalate when human authorization is required.
Investigation findings, decisions, and response actions remain connected through an evidence trail that supports operational review and accountability.
The Technology Behind HAWK Managed Detection and Response
Explore HAWK Managed Detection and Response (MDR) to see how the technologies introduced on this page support the service and its approach to security operations.