Prioritize alerts. Investigate threats. Coordinate response.

Name: Nova
Brand: Nova

Bring the daily work of the SOC into a connected investigation process. Nova combines alert triage, risk-based prioritization, behavioral anomalies, Threat Intelligence, and proactive Threat Hunting with the affected assets and identities. Analysts can open the details behind a concern, follow related activity, and coordinate the next steps through investigation and DRX response.

Request a private demo Prioritize the analyst queue

Security Operations Bring the daily work of the SOC into a connected investigation process. Nova combines alert triage, risk-based prioritization, behavioral anomalies, Threat Intelligence, and proactive Threat Hunting with the affected assets and identities. Analysts can open the details behind a concern, follow related activity, and coordinate the next steps through investigation and DRX response.

Incoming signals

Activity change

Cloud finding

Threat match

Context

EntityExposureThreatEvidence

Priority queue

Review firstReachable riskEvidence linked

InvestigateContext incomplete

MonitorLow-impact activity

The queue should explain what deserves attention

Analysts need more than severity. Nova connects exposure, entities, confidence, behavior, intelligence and evidence quality so priority can reflect likely impact and the investigation can start with context.

From alert to investigation

Observe
Prioritize
Investigate

Product experience

See how work moves through Nova

Move through current product views one step at a time. Each view answers a different security question and keeps the available evidence and limits visible.

Security event search Search 90 days of retained security activity with NQL, field filters and a normalized event table to validate the evidence behind an alert or investigation.

Detection alert posture Understand alert volume, risk, review progress, control strength and the 90-day activity trend in one operational view.

Nova Atlas Connect detection activity to geographic context and move from map concentration to the supporting alert evidence.

1 / 3

Operational workload

Make ownership, age and workflow state part of alert priority.

Teams can review unassigned work, aging items and high-risk alerts across the same queue, then move each case through a visible workflow.

Explore detection prioritization

Alert operations Manage alert workload by status, severity, score, owner and investigation progress while keeping the source evidence available for triage.

Context at first review

Start the investigation with why it triggered and what to verify next.

Priority, affected context, supporting evidence and suggested follow-up stay in the case so analysts can move from triage to validation without rebuilding it.

Explore evidence-grounded investigations