The system correlates information from sources such as SIEM, EDR, and other security monitoring tools to build context around incidents and generate investigation reports. It can observe file behavior in controlled environments, review process execution paths, and examine network activity connected to suspicious events. The platform also provides recommended response actions and integrates with existing security infrastructure through APIs to support incident triage and remediation workflows.intelligence.