In the product
An alert is one row: a rule name and a timestamp. The question that matters — what was actually happening around that moment — takes an analyst five consoles and twenty minutes to answer by hand. KosmicSignal answers it automatically.
A window around the alert (default −60/+15 minutes) shows every relevant action — sign-ins, role changes, process executions, resource access — in sequence.
Each actor, host, IP and indicator is enriched with identity, geo, threat intel and UEBA context, assembled at view time.
The risk score is computed from explicit signals — no black box. The same evidence always yields the same score, so it holds up in review.
Every fact names its source and query time, so an analyst — or an auditor — can trace exactly where a conclusion came from.