Understand Velora intelligence

Velora is the intelligence engine at the center of Nova. It connects alerts, findings, entities, activity, posture, threat context, timelines, and prior assessments so a team can understand the case without separating a conclusion from the evidence that supports it.

Velora reasons and recommends. It does not directly perform provider actions. When a supported response is appropriate, the recommendation moves to the separate DRX control path for scope, policy, approval, and execution review.

Evidence-grounded assessment

Connects the assessment to the records, findings, entities, and timelines that support it.

Entity and threat context

Builds a coherent view across identities, assets, behavior, exposure, and relevant threat information.

Baseline and change

Keeps expected behavior and meaningful drift visible without treating change as proof of compromise.

Memory with continuity

Carries forward relevant history, prior assessments, and unresolved questions without rewriting the evidence.

Investigation guidance

Frames the supported next question or action while confidence and uncertainty remain attached.

Response recommendations

Suggests a response for review in DRX. The recommendation does not run an action or grant permission to do so.

1. 01
   Observe

   Review the available source evidence and its quality.

2. 02
   Connect

   Relate entities, events, findings, timelines, baselines, and prior assessments.

3. 03
   Assess

   Separate observed facts, supported conclusions, assumptions, and unresolved gaps.

4. 04
   Guide

   Suggest further checks with references to the evidence, a confidence level and any limitations.

• Use the command center to review current priorities, evidence quality, and investigations that need attention.
• Use reasoning assessments to distinguish facts, supported conclusions, and unresolved questions.
• Use investigation guidance to ask a focused security question and continue into the underlying evidence.
• Use the threat graph to follow supported relationships across entities, activity, findings, and investigations.
• Use retained context to understand how the current case relates to prior assessments without treating history as new evidence.

Velora’s evidence-led foundation can assemble the case, entities, timeline, confidence, and quality state without relying on natural-language generation. This is the durable assessment layer.

Where included and permitted, Nova Prime can add citation-validated synthesis, briefings, and natural-language guidance for eligible cases. Prime adds assistance to Velora. It does not replace the evidence ledger or become a separate engine.

• Open the cited source records and confirm they support the stated conclusion.
• Check the selected customer scope, time window, entities, and evidence freshness.
• Distinguish an observed fact from an inference, recommendation, or unresolved question.
• Confirm that any proposed response follows the separate DRX approval and execution path.