Atalaya · Features
Every module, one data model.
Every module works on the same common model, keeps the link to the original source and respects workspace permissions.
Panorama
The workspace’s main dashboard: what you need to know at the start of a shift, with direct access to the evidence.
- Workspace KPIs: open and critical incidents, recent events, active vulnerabilities and affected assets
- Security Digest and recent activity
- Priority cases and quick links
- Every KPI opens the operational view with the same filters, so the numbers always add up
Events
Security events normalised from multiple tools. An event is a signal, not an incident.
- Server-side filters by time, source, severity, status, category, subsidiary, site, asset and text
- Detail showing what, when, where, what is affected and what evidence exists
- A link to the original source on every event
Connector Center
Control of integrations and ingestion, with transparent counters.
- Status per connector and connectivity tests
- Recent or full ingestion and selective runs
- History and logs with fetched, normalised, persisted and error counts
- Ingestion is kept separate from correlation
Assisted correlation
An agent that suggests relationships between events. It is advisory: it doesn’t change groupings or take actions.
- Relationships by indicators, assets, users and time proximity
- Similarity level, rationale and evidence
- The final decision always rests with the analyst
Grouping rules and Issues
Deterministic rules that turn events into units of work, fully traceable.
- Rules by source, type, severity, asset and time window
- Edit, assign, merge and split
- Change history and Jira synchronisation
Cases and Case file
A 360º file for every investigation, always keeping confirmed facts apart from hypotheses.
- Tabs: Summary, Initial evidence, IOCs, Sources, Correlated, Ticketing and MDR context
- MITRE ATT&CK, Playbook and Containment and response (network, endpoint, email, identity)
- AI memory, Original data and Export
Vulnerability Center
Technical exposure management, prioritised by real exposure and not only by technical severity.
- Top vulnerabilities, affected assets and focused analysis
- Search by CVE, QID, software, component or asset
- Asynchronous global search with visible progress and coverage
Vulnerability Metrics
Exposure and remediation analytics with clear definitions.
- Active and fixed, severity distribution and trends
- Comparison by subsidiary and fixes at 7, 30 and 90 days
- A clear split between “currently fixed” and “fixed in the period”
- Infrastructure findings separated from software-composition findings; PDF and HTML export
Asset Inventory
Technical and organisational context for every asset, with a unified identity across sources.
- Reconciled hostname, IP and external IDs
- Responsible person, subsidiary, site, operating system and software
- Vulnerabilities, events, cases and coverage per source
Intelligence
Threat intelligence you can reuse in investigations and workflows.
- Intelligence items from RSS, the web and external sources
- IOC enrichment
- What was observed internally is kept apart from external-only intelligence
Exposure Map
Interactive graphs to understand how assets, software, vulnerabilities, events and cases relate.
- Assisted graph investigation
- Documented and inferred relationships clearly told apart
- Navigate from any node to its detail
Shadow AI audit
Detection of AI tools and agent frameworks in the software inventory. Detection is not the same as declaring something malicious.
- Findings by host and product
- Compared with approved software and administrative risk
- Feeds review cases or tickets
Atalaya Studio
Custom dashboards from a natural-language description, always respecting workspace permissions.
- Request, draft, build, preview and publish
- Fork existing dashboards
- Review before publishing
Audit Log
Traceability of every operation on the platform.
- Who did what, when, on which object and with what result
- Includes agent and workflow actions
- Kept separate from technical logs
Export and reports
Reports that explain themselves: with their scope and provenance.
- PDF, HTML and JSON
- Scope, filters, sources and generation date included
- Ready for committees, audits and leadership
Want to see Atalaya with your own use cases?
We walk you through the platform with scenarios close to your organisation’s and look together at how it would fit your current tools.