Unified command for your security incidents
OrkSec centralizes alerts from your perimeter — WAF, SIEM, observability — enriches them with automated diagnostics and an asynchronous AI analyst, and drives every incident through a clear lifecycle. One screen, full traceability.
Everything your SOC does, in one place
Every view below is the real product — captured from a live OrkSec instance.
Unified command dashboard
The whole shift at a glance: incident metrics, SLA traffic lights, and live breakdowns by status, severity and origin.
- SLA expiry semaphore flags overdue incidents automatically
- Donut charts by status, severity and data source
- Paginated incident table with instant filtering
Geographic attack map
See where attacks come from. Every incident with a source IP is geolocated and plotted on an interactive world map.
- Interactive MapLibre map with incident clustering
- Severity-colored markers with incident details
- Spot campaigns and repeated origins at a glance
Kanban incident lifecycle
Drag incidents through a six-stage workflow: NEW → ANALYSIS → CONTAINED → ASSIGNED → ATTENDED → RESOLVED. Every transition is validated and audited.
- Structured transition dialogs — no skipped steps
- Mandatory closure evidence on resolution
- Parent/child grouping for repeated alerts
Asynchronous AI threat analysis
Move an incident to ANALYSIS and the AI agent takes over: OSINT, IP reputation, MITRE ATT&CK mapping — delivered as an executive Markdown report while your analysts keep working.
- OSINT enrichment: AbuseIPDB, VirusTotal, WHOIS
- MITRE ATT&CK technique mapping
- Telegram and email notification when the report lands
Leaked credentials tracking
A dedicated workspace for exposed credentials: reset lifecycle per credential, recurrence detection that flags likely infostealer infections, and scheduled reporting.
- Reset workflow: pending → requested → confirmed
- Recurrent credential detection across incidents
- Automatic weekday summary reports
Statistics & SLA analytics
Trends over time, mean resolution times and SLA compliance — the numbers your management asks for, without spreadsheets.
- Time-series trends by severity and status
- Average resolution and response times
- SLA compliance metrics per period
PDF & Excel reporting
Filter by date, severity, status or classification and export a branded report in seconds — interactive on screen, PDF or Excel for distribution.
- Rich filters: date range, severity, resolution, classification
- One-click PDF and Excel export
- Consistent branding in light and dark themes
Document repository
A secure archive for reports and official documents, linked to incidents, with automatic tagging and a per-access audit log.
- Built-in viewer for PDF and Office files
- Manual and automatic tagging, incident linking
- Every view and download logged per user
Data source management
Onboard a new tool in minutes: create a data source, issue its Bearer token, and start receiving incidents through the REST API — no code changes.
- Granular Bearer token per integrated tool
- Automatic sequential folios (INC-2026-0001)
- Enable, rotate or revoke tokens instantly
How the AI analyst works
Fully asynchronous: the analysis never blocks your team. Move the card, keep working, get the report.
Ingest
Perimeter tools push alerts to the REST API with their own Bearer token. Each incident gets a sequential folio.
Dispatch
Moving an incident to ANALYSIS fires a webhook to the AI agent with the analyst's instructions — and returns immediately.
Investigate
The agent runs OSINT: IP reputation on AbuseIPDB and VirusTotal, WHOIS, and MITRE ATT&CK technique mapping.
Report
The agent calls back with an executive Markdown report, stored with the incident and rendered in the UI.
Decide
Your analysts get notified via Telegram and email, review the findings, and decide containment with full context.
Plugs into the stack you already run
Native modules for the tools of a real SOC — plus a documented REST API for everything else.
Fortigate WAF
Parses raw WAF logs, classifies the attack type (SQLi, XSS…), extracts IPs and suggests port blocks.
Dynatrace Grail
Correlates security alerts with traces and metrics of the affected service — SecOps meets observability.
FortiSIEM
Direct connection with client credentials, connection testing and event queries from the settings console.
IPAM / GestioIP
Resolves subnet, host and responsible area for any internal IP — know instantly what segment is affected.
Telegram
Critical alerts and AI report notifications delivered straight to your SOC's group chat.
Email (SMTP + IMAP)
Sends incident briefs to assignees and converts their email replies into incident follow-ups automatically.
If it speaks HTTP, it plugs in
Every integration above rides the same open REST API. Any scanner, honeypot, cron job or in-house script can report incidents with a single authenticated POST — no plugins, no vendor lock-in.
POST /api/incidentsSee the API in actionBuilt for teams of every size
From a two-person security team to a 24/7 enterprise SOC, OrkSec centralizes the work and removes the busywork.
Small security teams
Get out of the inbox
- Replace email threads and spreadsheets with one board
- Automated intake means nothing gets lost
- AI analysis gives you senior-level enrichment without headcount
Growing SOCs
Coordinate the shift
- Kanban lifecycle keeps every analyst aligned
- SLA semaphores and folios bring order and accountability
- Role-based access separates operators, admins and viewers
Enterprise operations
Scale with full traceability
- Native WAF, SIEM and observability integrations
- Immutable audit trail and per-access document logs
- Parent/child incidents, automated backups, encrypted secrets
An API your tools will love
Every perimeter tool reports incidents with its own Bearer token. Folios, deduplication and notifications are handled for you.
Full payload contracts in the integration guide, including the AI callback.
curl -X POST https://your-orksec-host/api/incidents \
-H "Authorization: Bearer ork_ds_90fa1498880a32398448c360aea3a4da" \
-H "Content-Type: application/json" \
-d '{
"title": "SIEM Alert - Brute Force Attempt",
"description": "Multiple failed logins detected for user admin.",
"severity": "HIGH",
"responsible_area": "Cybersecurity",
"raw_payload": {
"src_ip": "203.0.113.88",
"rule_triggered": "942100",
"action": "BLOCKED"
}
}'Plans that fit your operation
Licensing adapts to your team size and deployment. Talk to us for a quote — no public price sheets, no surprises.
Starter
For small security teams
- Full incident lifecycle & Kanban
- REST ingest API with Bearer tokens
- Geographic attack map
- PDF & Excel reports
- Email notifications
Team
For growing SOCs
- Everything in Starter
- Asynchronous AI threat analysis
- Leaked credentials tracking
- Telegram + IMAP email intake
- Document repository with audit log
- SLA analytics
Enterprise
For 24/7 operations
- Everything in Team
- WAF, SIEM & observability integrations
- IPAM lookup and network tooling
- Automated backups & restore runbooks
- On-premise deployment (Docker)
- Priority support
See OrkSec on your own alerts
Tell us about your team and we will set up a guided demo with data that looks like yours.