1
Conductor
Orchestrates the passes and decides when to hunt.
One platform that evolves with your organisation. Every signal investigated.
Follow one signal through the pipeline: API pick-up, evidence gathering, a council of specialist agents, hypothesis-driven hunting, a two-model consensus check and a policy-gated decision.
The method ✦What you see ✦Signals ✦Specialist agents ✦Operating modes ✦Human in the loop ✦Observatory ✦The method ✦What you see ✦Signals ✦Specialist agents ✦Operating modes ✦Human in the loop ✦Observatory ✦
One signal in. One defensible decision out.
A conductor agent runs every signal through two passes, and loops back to hunt whenever the verdict is challenged. Every step is written to the trace.
- 1
Gather the evidence.
LuceraAI polls your tools’ APIs every 30 seconds and normalises each alert into a common signal model. The evidence agent pulls surrounding telemetry, including the process tree and sign-in history; an extraction agent pulls out hashes, domains, IPs and email addresses and scores them for reputation checks; a baseline comparator checks how similar signals were decided before.
- 2
Corroborate the verdict.
Domain specialists reach an initial verdict. A devil’s advocate builds the counter-case, and an independent model from a different provider gives a second opinion.
- 3
Test the hypothesis.
If the counter-case holds, LuceraAI writes its own hunting queries, records what it expects to find if the verdict is right or wrong, and runs them.
- 4
Recheck.
The verdict is reworked against the hunt results and checked again.
- 5
Decide and authorise.
A fixed-code policy engine applies your confidence thresholds and operating mode: close, escalate or act.
✦Star Chart · the foundation of every decision
It learns your organisation, so every verdict gets sharper.
Every agent, every verdict and every action starts here. Star Chart is LuceraAI’s knowledge of your environment, built from every signal and the assets within it, and fed back into every new investigation. Signals, Constellations and Observatory all draw on it.
- Organisation profile. Your industry, size and the software that’s routine for an organisation like yours, so a tool your sector runs every day isn’t treated as a stranger.
- Entities and relationships. File hashes, processes, IP addresses, domains, identities and assets, how often each has been seen, how they relate, and what verdicts they were part of.
- Context in every decision. Each new signal is weighed against what LuceraAI already knows, so responses get faster and more accurate over time.
- Explore it. A map of everything learned; the larger the star, the more often it has been seen. Drill into any entity to see its history and related signals.
✦Signals
Signals, not alerts. Every one gets due diligence.
Not everything your tools flag is a threat, so LuceraAI calls them signals. Each one is normalised into a common model, whatever its source, and investigated in full: the original alert is never overwritten.
Disagreement goes to a person. If the council can’t agree, confidence falls below threshold, or evidence is incomplete, the signal is held for human review with the reason recorded.
The verdict path
Every signal shows what happened, what was done and why: the path through both passes, each agent’s voice, the specialist findings, whether a second opinion or a person was needed, and the full audit log. It works for a SOC analyst who wants every detail and an IT manager who wants the answer. LuceraAI verifies each action took effect in your tools, and lists recommended next steps.
Hunting
When the evidence is thin, LuceraAI writes its own hunting queries around the signal: the activity before and after the event on the same device and identity, and comparable signals it has seen before. Each hunt states its hypothesis up front, so you can see whether the results supported or refuted it.
Reports. An executive summary and full technical report for every signal, downloadable as a PDF and written back into your EDR incident and ticket.
✦Constellations
Connected signals become one incident.
When signals turn out to be part of the same threat, LuceraAI groups them into a constellation, so you see the bigger picture instead of a stack of tickets.
- How they form. Signals that share a host, identity, process lineage or time window are correlated, including across sources: a phishing email, the sign-in that followed and the process that ran.
- Deterministic correlation. The rules that join signals are fixed, so you can always see why two signals were linked.
- Investigated as a whole. The council weighs the constellation’s combined evidence, not each signal in isolation.
✦Observatory
See every device. Find the ones your tools miss.
Observatory is cyber asset management built into LuceraAI. It takes feeds from the tools you already run, builds one view of every device, and adds that context to every signal.
- One asset model. Records from SentinelOne, Microsoft Defender, Intune, CrowdStrike Falcon and Cloudflare WARP are normalised and matched into a single device, even when one tool keeps a record per signed-in user or a device is rebuilt and renamed.
- Device properties. Operating system, agent versions and agent history, and which tools can see each device.
- Gap explorer. Choose two sources and see what one sees that the other misses. Export the list as CSV.
- Tags. Group assets by hand, or by rule, such as operating system family or hostname pattern.
- Coverage policies. Set the tools each tag must have. When an asset falls outside policy, Observatory raises a signal for your team.
- Context for verdicts. Knowing what a device is and what it should run helps the council judge what it sees.
✦operating modes
Start by watching. Act when you’re ready.
Observe proves the decisions. Insights puts the investigation in front of your analyst. Orchestrate acts when evidence and policy align, with a higher bar for disruptive actions. Set the mode per site, so servers can stay in Observe while laptops move to Orchestrate.
1 · observe
Observe
See every verdict and its evidence, with no automated response.
same incidentVerdict and evidence recorded. No action taken.
2 · insights
Insights
Full investigation and a recommended response. Your analysts decide.
same incidentRecommended: isolate FIN-LT-0142. Analyst approves or declines.
3 · orchestrate
Orchestrate
Response through your EDR when confidence and your policy both allow it.
same incident94% clears the 90% bar for isolation, which you enabled. Endpoint isolated and logged.
Works with the tools you already own.
New integrations are built in the order customers ask for them.
This is some text inside of a div block.
This is some text inside of a div block.
This is some text inside of a div block.
This is some text inside of a div block.
This is some text inside of a div block.
This is some text inside of a div block.
This is some text inside of a div block.
This is some text inside of a div block.
This is some text inside of a div block.
This is some text inside of a div block.
This is some text inside of a div block.
This is some text inside of a div block.
This is some text inside of a div block.
This is some text inside of a div block.
This is some text inside of a div block.
This is some text inside of a div block.
This is some text inside of a div block.
This is some text inside of a div block.
The parts that touch your environment are code you can inspect.
- Stateless models. Every AI request is one-shot. Context lives in the platform, not the model, so there is no conversation history to extract through prompt injection.
- Tenant isolation. Encrypted databases and per-tenant encrypted storage, with per-tenant rate limits so one busy estate can’t slow another.
- Fail-safe by design. A model error, malformed response or incomplete evidence holds the signal for human review, with the reason recorded.
- Least privilege. Read-only API access in Observe mode; scoped permissions for Insights and Orchestrate.
- Access control. SAML and OIDC single sign-on, TOTP MFA, roles and a full audit trail.
- Deployment. Multi-tenant in AWS London, or a dedicated instance in your own AWS account.
✦Human in the loop
No analyst on shift? Ours are.
When LuceraAI hands a case to a person, it does not have to be yours. Add our optional review service and UK analysts from the team that builds LuceraAI pick up every escalation, check the evidence and make the call.
✦
Every hand-over reviewed. Low confidence, model disagreement or missing evidence goes to a named analyst, not a queue.
✦
Same receipt, one more signature. The analyst's decision and reasoning are added to the record, so you can see who decided and why.
✦
You stay in charge. We act only within the operating mode and actions you have enabled, and call you when something needs your decision.
✦
Full coverage. Here to support 24/7, when your analysts can't.
.png)
✦do our stars align?
Your alerts. Our working.
A two-week, read-only evaluation in Observe mode. Nothing acts on your estate.