Where agents work in the open.
Active Canvas is the workbench behind every Irate investigation: the agent, its playbooks, its tools and every step it takes. Our analysts can watch it live, review it and stop it.
Agents and analysts, one surface.
Black-box AI has no place in a SOC. In Active Canvas, analysts watch investigations unfold, step in mid-run, and re-run a case with one instruction.
Playbooks the agent actually follows.
Investigations load skills written by practitioners for phishing, identity compromise, malware, data movement, threat-intel matches, cloud and endpoint. The agent works the way your best analyst would, every time.
- Class-aware: each detection type gets its own path
- Per-client playbooks and context
- Skills versioned with the platform
Tools behind guard rails.
The agent reaches your security tools through Irate’s own tool layer: outputs are bounded so evidence isn’t lost, and workflow execution in your environment is blocked unless you explicitly enable it.
- Investigation tools by default
- Execution switched off unless enabled per client
- Large evidence kept intact
- Tool callEmail security: get click forensics
- Tool resultURL detonated · credential form · 7/90 engines
- Tool callEDR: process tree for FIN-WS-01
- Tool callIdentity: sign-ins for jdoe, last 24h
- FindingNew sign-in from unfamiliar ASN, 6 min after click
Built for a model-agnostic future.
Active Canvas runs each client on the model that suits its risk and cost profile, and keeps the evidence contract the same whichever model does the work.
Bring us your backlog.
Thirty minutes, no slideware. Watch Irate work last week’s alerts on your own data.