Knowledge base
Everything a security team needs to roll SOC360.AI out: a 30-day sequence, who owns what, a tour of every workspace, an honest status list of what is production-ready today, and the handful of things only you can supply.
Tutorial · 30 days
Week 1
Create the organisation, invite the team, and connect two or three read-only sources you trust most — usually SIEM, endpoint and vulnerability management. Nothing is installed in your environment; you are issuing read-only API credentials.
Week 2
Let correlation run. Related findings that share an IP, host, identity, domain, hash or CVE collapse into a single case with shared evidence. Review What Needs Action daily and confirm the grouping matches how your team thinks about work.
Week 3
Configure alert rules and response deadlines so slipping work is visible before it becomes a board question. Set retention per data type and schedule snapshots so you can prove what you knew and when.
Week 4
Generate the executive report from live data, compare it against the previous period, and walk it through with one business stakeholder before it reaches the board. From here the cycle repeats on its own.
Who does what
Weekly
Lives in Board View and Reports. Checks movement since last period, the deadlines at risk, and the two or three actions worth escalating.
Daily
Works What Needs Action and Cases. Confirms grouping, assigns owners, and pushes work into the ticketing system where it gets done.
Daily
Work in their own tools. Status flows back automatically through two-way ticket sync — nobody re-keys updates into a second console.
Monthly
Uses Reporting & evidence and AI governance. Maps live evidence to control frameworks and exports audit-ready packs instead of chasing screenshots.
Product tour
Command Center, What Needs Action, Board View and My Exposure. Open Command Center for the live picture; open What Needs Action when you want the short list of things that actually need a decision.
Cases, Incidents, Alerts & Deadlines, Vulnerabilities, Identity Risk, Microsoft 365 & Cloud, Tickets. This is the working queue — correlated, owned and deadline-tracked.
Live Threat Map, Global Security Map and Threat Intelligence. Answers the only intel question that matters: is this happening to us?
Reports, Custom Dashboards, Backup & Export, Retention & Recovery. Board packs, regulator evidence, snapshots and restore — all from live data.
AI inventory, EU AI Act classification, assessments, vendor questionnaires, controls and policies for the AI systems and vendors in your environment.
Portfolio and onboarding for MSSPs, plus integrations, users and roles, demo/live data, branding and administration.
Straight status
Adoption FAQ
First connections are typically live in days because everything is read-only and agentless. Most teams have a usable board pack inside the first month.
No. Assignment, triage and closure stay in your ITSM or SIEM. SOC360.AI groups the signals, tracks the deadlines and reports the status.
It stays blank. The platform never fills gaps with estimated or sample figures — an empty field means nothing was recorded, and that distinction matters in an audit.
Yes. Sample data can be provisioned and flushed separately from live data, so demonstrations never contaminate your real picture.
The full handbook covers the business case, how the platform works end to end, the 30-day rollout, role playbooks, a capability evaluation, external prerequisites, success measures and FAQs.