Aegis is NESQ’s AI SOC system, combining artificial intelligence, EDR and XDR capabilities, and operational threat response. It analyses events, connects evidence, assesses context and takes action to counter a compromise.
A proactive presence within the organisation’s digital ecosystem, supporting the IT manager and acting autonomously within its authorised operational scope.
From event to decision
An unusual login, a suspicious process or an anomalous communication may be an isolated signal or part of the same attack. Aegis correlates this information to reconstruct what is happening and identify priorities.
Its assessment considers asset criticality, the identities involved, observed behaviour and potential operational consequences. This helps focus attention on events that require concrete action.
EDR and XDR: connected protection
EDR, Endpoint Detection and Response, capabilities detect and investigate suspicious activity on workstations and servers: anomalous processes, malicious execution, persistence attempts and behaviour consistent with a compromise.
XDR, Extended Detection and Response, capabilities extend the analysis to other integrated security sources. Endpoints, networks, identities, email and cloud environments can contribute to the same investigation.
Coverage depends on the connected sources and available telemetry: the more complete the context, the more relevant the decisions can be.
Speed where it matters
During an attack, the time between detection and containment can affect the likelihood of propagation and the business impact.
Aegis accelerates information gathering, event correlation and initial assessment. Repetitive tasks are automated, while relevant evidence is organised to support timely decisions.
When the conditions defined by policy are met, the system can initiate authorised actions without waiting for every individual alert to be handled manually.
Learning and contextual understanding
Aegis uses business context, investigation outcomes and operator feedback to refine its assessments. Understanding normal behaviour helps distinguish legitimate activity from a deviation that deserves attention.
Experience gained through event handling contributes to recognising recurring situations, prioritising events and making responses more relevant.
Improvement is assessed through observable results: alert quality, false positives, analysis time and the effectiveness of interventions.
A proactive system
Aegis looks for weak signals and suspicious sequences that may precede an evident incident. Its analysis can connect login anomalies, endpoint activity and communications to suspicious destinations.
Relevant scenarios include credential abuse, privilege escalation, persistence, lateral movement and possible exfiltration attempts.
Proactive investigation allows a suspicion to be examined even when an individual event, considered on its own, does not appear decisive.
Operational response and governed autonomy
Aegis can operate at different levels of autonomy, defined according to risk and organisational needs:
- Assisted mode: analyses the event and proposes actions for the IT manager to assess.
- Approval mode: prepares the intervention and executes it after authorisation is received through the application.
- Autonomous mode: decides and executes actions permitted by policy, using evidence, context and operational experience.
Depending on the available integrations, interventions may include isolating an endpoint, blocking malicious communications, quarantining a file, stopping a suspicious process or revoking a compromised session.
Autonomy is configured with regard to detection confidence, system criticality and the action’s impact on business continuity.
The IT manager remains in control
The application enables the IT manager to interact with Aegis, assess alerts and authorise interventions that require a human decision.
For each event, the operational workflow must make the available evidence, the system’s assessment, the proposed or executed action and its outcome understandable.
Traceability, accountability and verification accompany automated response and allow decisions to be reviewed.
Technology and NESQ expertise
Aegis is part of the NESQ approach: technical analysis, threat knowledge, incident response and attention to evidence preservation.
The objective is to reduce the time needed to understand an event and take action, while maintaining a clear view of risk and operational consequences.
Discover how to integrate Aegis into your organisation’s security. NESQ works with your team to define connected sources, priority scenarios, levels of autonomy and intervention procedures.