From raw telemetry
to a contained incident.
The hub beneath the SOC: it reads the tools you already own, turns their noise into one timeline, and hands a confirmed incident to an analyst who can act on it. Built and hosted on AWS.
ViSH is the console beneath Vijilan's SOC. Four stages: it connects to the security tools you already own, ingests their telemetry over syslog and API, correlates and enriches that into single timelines, and hands confirmed incidents to a 24/7 US-based SOC that acts on them.
It is built and hosted on AWS. Cribl shapes the pipeline, CrowdStrike Falcon and Falcon Next-Gen SIEM provide endpoint signal and retention, and Corelight covers the network between endpoints. Praxis AI™ is the SOC platform above it.
Nothing gets replaced to make this work. Any source reachable by syslog or an API can be connected, and every containment decision is made by a trained human analyst informed by Praxis, not by an algorithm acting alone.
Four stages,
one direction.
Your existing tools, as they are
Syslog and API into one pipeline
Correlated, enriched, prioritized
A 24/7 US-based SOC acts
01 Your existing tools, as they are.
02 Syslog and API into one pipeline.
03 Correlated, enriched, prioritized.
04 A 24/7 US-based SOC acts.
Connect your existing tools
Nothing gets replaced. ViSH reads the tools already in the estate, cloud and on-premises, through vendor APIs and syslog. Anything reachable by syslog or an API can be a source, which is why the list below is a sample rather than a limit.
Microsoft 365
Carbon Black
Microsoft Entra
A sample, not a limit. Any source reachable by syslog or an API can be connected. See every integration.
Ingest over syslog and API
Telemetry is normalized as it lands, so an authentication event from one vendor and the same event from another are comparable by the time an analyst sees either. Cribl shapes and routes it at the edge, which is what keeps volume from deciding what you can afford to watch.
Analyze: the Vijilan core
The Vijilan core links events across every source into one timeline, enriches each signal with current adversary context, and scores what reaches the queue. Automation does the heavy lifting here. It does not get the last word.
Correlation engine
Links events across every connected source into a single timeline, so a login, a process and an outbound connection read as one story rather than three alerts.
Threat intelligence
Enriches every signal with current adversary context, so a hash or a domain arrives already carrying what is known about it.
Machine learning and AI
Scores and prioritizes what the analysts see. It decides the order of the queue, not what happens to the estate.
Automation does the heavy lifting; analysts confirm every call. Every containment decision is made by a trained human analyst informed by Praxis, not by an algorithm acting alone.
Respond: a 24/7 US-based SOC
A confirmed detection becomes a case with its evidence already attached, routed to the analysts who own that estate. They triage, respond and remediate, then the incident lands in the queue your team already works from.
Correlated evidence packaged into one case.
Routed to the analysts who know the estate.
Triage, respond, remediate.
Threat stopped and the customer told.
Autotask
Alerts and incidents land where your team already works, and sync with the RMM, PSA or CRM you run. The portal carries data management, alerts, incidents, reports and search alongside it.
One enterprise stack,
four jobs.
ViSH is Vijilan-built. What it runs on is not, deliberately: each layer is a platform an enterprise buyer can evaluate on its own terms.
The hub itself is built and hosted on AWS. Regional capacity is why a US-based SOC can hold data where a customer needs it held.
Routes, reduces and shapes telemetry before it reaches storage. This is the layer that decides what a SIEM costs and what it ever gets to see.
Falcon for endpoint, identity and cloud signal, and Falcon Next-Gen SIEM on the index-free LogScale engine for retention and search.
Network detection and response, extending coverage past the endpoint to the traffic between them, where an agent cannot go.
The services
this pipeline delivers.
The architecture,
answered plainly.
What is the Vijilan Information Security Hub (ViSH)?
ViSH is the console beneath Vijilan's SOC. It connects to the security tools an organization already owns, ingests their telemetry over syslog and API, correlates and enriches it into single timelines, and hands confirmed incidents to a 24/7 US-based SOC that acts on them. It is built and hosted on AWS.
Where is ViSH hosted?
On AWS. The pipeline runs on Cribl, endpoint and SIEM on CrowdStrike Falcon and Falcon Next-Gen SIEM, and network detection on Corelight. Praxis AI™ is the SOC platform that sits above ViSH and drives triage and response.
Do I have to replace my existing security tools?
No, and that is the point of the first stage. ViSH reads what is already deployed through vendor APIs and syslog, cloud and on-premises. Any source reachable by syslog or an API can be connected, so an existing EDR, firewall or identity provider stays in place and starts contributing signal.
What log sources and data types does ViSH support?
Seven domains: networks and firewalls, applications, users and identity, data, cloud services, devices and EDR, and third-party ingest. In practice that covers firewall and VPN logs, endpoint and EDR telemetry, authentication and directory events, SaaS and cloud audit trails, email security, network metadata, and anything else that speaks syslog or exposes an API.
Does automation contain incidents on its own?
No. Automation correlates, enriches and prioritizes, which is the heavy lifting. Every containment decision is made by a trained human analyst informed by Praxis, not by an algorithm acting alone.
Where do incidents end up?
In the queue your team already works from. Incidents escalate into ConnectWise, Autotask, Freshdesk, Zendesk and other PSA, RMM and ticketing systems, and the portal carries alerts, incidents, reports and search alongside it.
Related reading
- The platform overviewPraxis AI, ViSH and Falcon, and which layer does what.Read
- Every integrationThe full connector list rather than the sample on the diagram.Read
- Cribl Stream pipelinesThe layer that decides what your SIEM costs and what it ever sees.Read
- NextDefendFalcon Next-Gen SIEM, operated on the index-free LogScale engine.Read
- SOC as a serviceWhat the people at the end of the pipeline actually do.Read
The diagram is general.
Your telemetry is not.
Bring the tools you already run and we will show you what ViSH reads from them, what it correlates, and what the SOC would have acted on.