Investigation / Governed response
SOAR is the governed response layer for typed evidence, investigation, scenario rehearsal, approval gates, rollback, and operator-controlled action.
SOAR console · soar.bwtr.ai. Console access may require authentication.
01 / PRODUCT POSITION
Agents can reason over claims and propose response paths, but action stays tied to evidence class, scope, health checks, and a named decision owner.
02 / FEATURE FILMS
Source-product films reused from the original marketing sites. They are useful marketing proof, not production certification.
01 / Evidence ceilings
Represent every answer as a bounded claim so no summary outruns the evidence class that produced it.
02 / Detection without overreach
Run detection rules over logs and packet metadata while preserving provenance and avoiding raw payload retention.
03 / Hypothesis-driven investigation
Hunt across logs, the estate graph, and grounded threat intelligence with visible source citations.
04 / Response before production
Replay incidents and test response paths in a twin so proposed action carries blast radius and rollback context.
05 / AMBER to GREEN
Separate proposal from actuation. GREEN execution requires policy bounds, health checks, and recoverable plans.
06 / Close the loop
Re-run original checks and retain fresh evidence before calling a fix complete.
SOAR is operator-gated. Active response requires separate authorization, local execution boundaries, and recoverable plans.
03 / CAPABILITY MAP
Represent every answer as a claim with provenance and a bounded evidence class.
Use twin/range context to test response paths before acting on production systems.
Keep containment and remediation behind explicit authority, safety cases, and executor parity checks.
Compare analyst, skeptic, and response-engineer viewpoints without upgrading weak evidence.
Preserve air-gapped and zero-egress modes for sensitive investigation contexts.
Record who asked what, what tools were used, and what evidence supported the response.
