Every finding lands somewhere
with a name on it.
Detection is the easy half. The half that decides whether a finding gets fixed is routing it to the right person, escalating when nobody picks it up, and being able to prove afterwards who closed it and when. That runs on the same collector as the scanning and the compliance evidence — so the alert arrives with its context already attached.
From detection to close,
without a second tool in the path
Severity is decided at the collector
Every finding arrives already scored — by AI behavioral baselines, by policy match, and by the classification of the data involved. A critical alert on classified cardholder data and an informational one on a dev instance do not travel the same path.
Routed to whoever is actually on call
Slack, Teams, email, PagerDuty, or any webhook, filtered per destination so the compliance team and the on-call engineer do not receive the same firehose. Events also forward to 14 SIEM platforms in each one’s native format.
Escalated on a timer, not on hope
Multi-level policies promote an alert automatically when nobody acknowledges it, and again when nobody resolves it. The delays and conditions are yours to set — the point is that an unacknowledged critical cannot sit quietly forever.
Acknowledge, resolve, and prove it later
Alerts carry state. Acknowledging one stops the escalation clock; resolving one closes it and fires a webhook so your other systems stay in step. The full history — first detection to close — is retained as evidence.
Every alert carries its own evidence
This is what the shared inventory buys you. An alert does not just say something happened — it arrives with the query, the session, the OS user, the file that changed, and the data classification already attached. Nobody has to go and assemble the context first.
Escalation you can read
before you buy it
Not a diagram of how it might work. This is the actual policy format: three levels, real conditions, real delays.
escalation:
- name: security-incident
levels:
- level: 1
delay: 0
channels:
- type: slack
channel: "#security-alerts"
- type: email
recipients: [security@company.com]
- level: 2
delay: 15m
condition: not_acknowledged
channels:
- type: pagerduty
service_key: ${PAGERDUTY_KEY}
- type: slack
channel: "#security-urgent"
mention: "@security-lead"
- level: 3
delay: 30m
condition: not_resolved
channels:
- type: pagerduty
service_key: ${PAGERDUTY_EXEC_KEY}
- type: email
recipients: [ciso@company.com]
auto_resolve:
enabled: trueFull reference in thealerting docs, with destination setup underalert destinations.
What this is,
and what it is not
We do not replace your ticketing system — we make sure it gets a finding worth opening a ticket for, with the query, the user, the file, and the data classification already attached.
What ships
- Severity scoring and per-destination filtering
- Routing to Slack, Teams, email, PagerDuty, webhooks
- Forwarding to 14 SIEM platforms in native formats
- Multi-level escalation with delays and conditions
- Acknowledge, resolve, and auto-resolve
- Full alert history and pattern analysis
- Dashboard, CLI, and API access to all of it
What it deliberately is not
- An ITSM system of record — yours stays where it is
- A work queue with per-analyst assignment
- A SOAR platform running automated remediation
- A replacement for your on-call rota tooling
If you want people doing the judgement calls rather than software doing the routing, that is what Managed Database Security and theIR retainer are for.
The third pillar is not
a third product
Routing and escalation are configured beside your audit policies and your scan schedules, under the same role-based access, driven by the same collector. There is nothing extra to deploy and no separate contract to renew.
Cost
No per-seat on-call licence and no per-GB ingest to route your own alerts. Routing, escalation, and history ship with the platform, so the marginal cost of the third pillar is zero.
Ease of use
Escalation policies are YAML or a form, in the console you already deployed. There is no separate on-call product to onboard, no second directory of who is on rota this week.
Runs local
Escalation runs inside your network. Air-gapped and sovereignty-constrained estates alert to local destinations without an egress path, which a cloud-only on-call service cannot do.
AI that decides what is worth waking someone for
Escalation is only useful if it is not firing on noise. Behavioral baselining scores each deviation before anything routes, so the 02:00 page is the one that deserved it.
Cited by 49 of the 57 frameworks
we map
Each one below has at least one cited requirement whose evidence this capability produces. Follow any framework through to see the exact articles and why.
See what your alerts would look like
Enter your business email and tell us where your team already works. We'll show you the routing and escalation running against findings from an estate like yours.