AgentODYSSEYBlue Team AI, running in your SOC.
A multi-agent AI system that runs security operations across detection, investigation, response, and threat intelligence — carrying the toil while human judgment stays in the loop.
< 10 min
Alert acknowledged
vs 45–120 min
100%
Alerts triaged
vs ~55% investigated
< 30 min
Automated response
vs 4–8 hours
The security challenge
Attacks scale faster than teams can hire
Indonesian organizations face attacks that keep getting faster, cheaper, and more automated — and no amount of hiring closes the gap economically. The answer is to change the economics, not pile on headcount.
207days
Average dwell time before a compromise is detected.
3.4M
People short in the global cybersecurity workforce.
45%
Of alerts never get investigated (IBM).
40%
Of analyst time spent chasing false positives.
What ODYSSEY is
A multi-agent system inside the SOC
ODYSSEY coordinates specialized AI subagents across the incident-response lifecycle, with a human analyst in the loop for every decision that matters. Each subagent draws on a shared semantic memory — what's learned in one investigation carries into the next, no retraining required.
PICERL
Incident Response
Runs the full SANS PICERL cycle — Preparation, Identification, Containment, Eradication, Recovery, Lessons Learned. Correlates events across sources, writes structured incident reports, and triggers pre-approved containment on approval.
Enrichment & attribution
Threat Intelligence
Turns raw indicators — IPs, domains, hashes, URLs — into context: threat-actor attribution, MITRE ATT&CK mapping, malware family, and campaign linkage. Feeds detection tuning and executive briefings.
Hypothesis-driven
Threat Hunting
Runs hypothesis-driven hunts across log data for the patterns rule-based detection misses. Every hunt is logged to shared memory, so the next one starts where the last left off — accumulated operational edge.
See it investigate
Grounded answers, not a chatbot
Every verdict traces to live evidence. Watch ODYSSEY route a task to the right subagent, reason across sources, and return an evidence-linked verdict — with a human gate on anything irreversible.
Analyst
Investigate alert #48213 — suspicious PowerShell on FIN-DB-03
Reasoning · grounded in live evidence
- ✓Pulled 3 correlated events across EDR, AD, and firewall
- ✓Reconstructed a 6-step attack sequence from raw logs
- ✓Mapped blast radius — 2 assets in the lateral path
Evidence cited
- → evt:edr-9931 encoded PS payload
- → evt:ad-2207 anomalous logon
- → evt:fw-5540 C2 beacon 185.220.101.47
Verdict
Severity
High
Risk
82 / 100
Confidence
0.91
Recommended action
Isolate FIN-DB-03 · revoke sessions · block C2 in DNS (PB-07)
⚠ Containment requires analyst approval — irreversible action gated
How it works
Hub-and-spoke orchestration
A central orchestrator reads each request for intent, routes it to the best-placed subagent, and tracks state across multi-step workflows — logging every routing decision so you can always audit who handled what, and when.
Alerts & requests
Orchestrator
Routes tasks · tracks state
Incident Response
Threat Intelligence
Threat Hunting
Shared semantic memory
Cross-session knowledge · hunt logs · incident context
Chained workflows. When a hunt turns up an anomaly above threshold, Threat Hunting hands off to Incident Response, which pulls in Threat Intelligence for enrichment — the orchestrator carries context cleanly from one agent to the next.
Capabilities
Five operational domains
Each maps to a measurable outcome, not just an activity.
Detection & continuous monitoring
- Real-time analysis 24/7
- Behavioral baselining beyond signatures
- Cross-source correlation
- Full MITRE ATT&CK coverage
Investigation & root cause
- Automated triage with confidence scoring
- Timeline reconstruction from raw logs
- Blast-radius & lateral-movement mapping
- Plain-language summaries
Incident response (PICERL)
- Real-time scoping & declaration
- Containment on approval
- Root cause through verified recovery
- Post-incident detection-gap findings
Threat intelligence
- Indicator enrichment
- Actor profiling with confidence
- ATT&CK & kill-chain analysis
- Intelligence-to-detection pipeline
Threat hunting
- Hypothesis-driven hunts
- Persistent cross-session memory
- Reusable hunt playbooks
- Auto-routing into IR on threshold
Delivery models
Deploy it standalone, or as an intelligence layer
ODYSSEY is modular. Run it as a focused product for one specific need, or as a layer that lifts the Zentara platforms you already run — without changing how your team works.
Standalone products
Odyssey DFIR
Digital Forensics & Incident Response
On-demand forensic investigation. Rebuilds the attack timeline, pinpoints the initial-access vector and lateral-movement path, and works out how much data actually left — structured reports with remediation, and a verified clean state before the case closes. Per incident or on retainer.
Odyssey Malware Analysis
Automated triage & behavioral analysis
Automated triage of suspicious files. Extracts indicators, maps observed behavior to MITRE ATT&CK, and attributes the malware family with a confidence score. Analyst-ready reports that feed straight into detection tuning and threat intelligence.
The platforms you already run
One capability, two homes
ODYSSEY’s digital-forensics engine — attack-timeline reconstruction, initial-access and lateral-movement tracing, exfiltration assessment — runs both as the standalone Odyssey DFIR product and embedded inside ZEN iNTEL, so the same forensic depth is available wherever your investigation starts.
Vendor-agnostic by design
Your stack. Your data. Your infrastructure.
ODYSSEY is built on an open-source, self-hosted foundation. In practice that means full data sovereignty, no vendor lock-in, and compliance with Indonesia’s data-residency rules without architectural workarounds.
- Connects across ZX, Splunk, Elastic, and Sentinel — not tied to one SIEM.
- On-premises by default for data-sensitive workloads; Jakarta-region cloud for managed scale-out.
- Client security data never leaves the client's own infrastructure.
- The AI reasoning layer is stateless — the model provider retains no customer data.
- Encryption throughout, least-privilege access, MFA, full audit logging, human approval on irreversible actions.
The technology foundation
Enterprise security, without the enterprise budget
Put ODYSSEY on your alert queue
See it triage, investigate, and enrich against a real scenario — your environment, your questions, an analyst walking you through every grounded decision.
The business case
Automation changes the economics
A traditional analyst-only team, against the same team running ODYSSEY.
Vision & roadmap
Analyst-led first. Then progressively autonomous.
The roadmap shifts who starts triage — from the analyst to the system. It's earned in production, not promised on a slide.
Phase 1 · Today
Analyst-led
An alert comes in, an analyst decides to dig in and prompts ODYSSEY, and ODYSSEY does the work — faster and more thoroughly than a person working alone. The analyst starts each task. It works in production today.
Phase 2 · Earned next
Progressively autonomous
ODYSSEY watches the queue continuously and opens investigations without being asked. The analyst reviews findings, signs off on high-stakes actions, and handles the edge cases — becoming the oversight, not the trigger. Only after the foundation proves itself.
FAQ
Common questions
Straight answers. If yours isn't here, ask us directly.
Human-in-the-loop by design. In Phase 1, analysts drive each investigation and ODYSSEY does the analytical heavy lifting. In Phase 2, it watches the alert queue and starts triage on its own — but a human still signs off on every high-stakes and irreversible action. Autonomous triage only comes after the system has proven itself across hundreds of real engagements. There's no shortcut, and we don't pretend otherwise.
Change the economics of your SOC
Enterprise-grade security shouldn't require an enterprise-grade budget. See what ODYSSEY does on your alert queue.