IT & Security · Module
Security Center
Alert triage, incidents, vulnerabilities and access reviews with context and evidence
Security Center ingests alerts and findings from the tools you already run, enriches them with owner, device and identity context, and turns them into incidents, remediation work and access reviews. CERT-In and breach workflows are designed in.
What it does
Security Center is planned for W4 as the security-hygiene layer. It is not a SIEM or EDR. A security asset inventory aggregates devices, CIs, identities and service accounts, repositories, cloud accounts and SaaS apps with owner, criticality and data classification.
Alerts with context
Alert ingestion starts with Wazuh, Microsoft Graph security alerts, Google Workspace alert center, One3 platform signals (sign-in and Action anomalies, AI Governance incidents), Device Management compliance events and a generic authenticated webhook. Alerts are normalised to a common schema, deduplicated by fingerprint and correlated into groups, and enriched with asset owner and criticality, device compliance, identity context such as recent MFA reset or leaver status, open vulnerabilities and related ITSM incidents. AI alert triage proposes severity and disposition with rationale and a suggested playbook. Analysts work in a queue with SLAs by severity and suppression rules that expire.
Incidents and response
Security incidents move through identification, containment, eradication, recovery and lessons learned, with evidence hashed and a chain-of-custody log. Response playbooks for compromised accounts, malware, lost devices, phishing and leaked secrets call Actions such as revoke sessions, disable account, reset credentials and quarantine device, each with its approval rule. The CERT-In incident pack classifies against a configured list, starts a reporting clock and drafts the report; submission is a human R4 Action. A personal-data breach handoff creates a record in Privacy Ops, or a breach-lite record when it is not subscribed. All regulatory items must be verified.
Vulnerabilities
Findings come from Wazuh, Dependabot and code scanning through DevHub and CSV, with Qualys, Tenable and Defender at GA. Prioritisation uses CVSS, the known-exploited flag, asset criticality and exposure with an explanation. Remediation assigns owners, sets SLAs, raises tickets in ITSM or Issues & Sprints, verifies by rescan and records risk acceptance with expiry.
Access reviews and posture
Access review campaigns snapshot entitlements from One3 Identity and connected apps, add AI recommendations, collect reviewer decisions, execute revocations and seal the evidence pack for GRC. Continuous access monitoring finds leaver accounts still active, orphan accounts and dormant privileged access. Phishing report analysis, a posture dashboard and evidence export complete the module.
Features
What Security Center includes
Security asset inventory
Devices, CIs, identities, service accounts, repositories, cloud accounts and SaaS apps with owner and criticality.
Alert ingestion connectors
Wazuh, Microsoft Graph security, Google Workspace alert center, One3 platform signals, device compliance events and authenticated webhooks.
Normalisation, dedupe and correlation
Common alert schema, fingerprint dedupe in a time window and correlation by asset, identity and technique.
Enrichment
Owner, criticality, device compliance, privileged and leaver status, last sign-in, open vulnerabilities and related incidents.
AI alert triage
Severity and disposition proposals with rationale and suggested playbook, evaluated in shadow first.
Triage queue and workbench
Queues by severity and source, SLAs, bulk close with reason and expiring suppression rules with approval.
Security incident management
Phased incidents with timeline, tasks, hashed evidence and chain-of-custody log.
Response playbooks with Actions
Compromised account, malware, lost device, phishing and leaked secret playbooks calling tiered Actions.
CERT-In incident pack
Classification against a configured list, reporting clock, report draft and submission evidence (verify).
Personal-data breach handoff
Breach record in Privacy Ops or a breach-lite record with configured clocks and decision log.
Vulnerability intake and prioritisation
Wazuh, Dependabot, code scanning, Qualys, Tenable and Defender findings ranked by CVSS, KEV flag and criticality.
Remediation and exceptions
Owner assignment, SLA by priority, tickets, rescan verification and risk acceptance with expiry.
Access review campaigns
Scoped campaigns over One3 Identity and connected apps with keep, revoke and modify decisions and escalation.
Continuous access monitoring
Leaver accounts still active, orphan accounts, dormant privileged accounts and MFA gaps raise remediation tasks.
Phishing report analysis
Header, authentication, link and attachment analysis, verdict with evidence and removal proposals.
Posture dashboard and evidence export
MFA coverage, device compliance, patch currency and overdue vulnerabilities, with signed evidence packs for GRC.
Workflow
Alert to incident with CERT-In clock
- 1
Alert normalised, deduplicated and enriched
- 2
AI proposes triage
- 3
Analyst disposes or declares an incident
- 4
Reportable incidents start the clock and draft a report
- 5
Playbook containment runs with approvals
- 6
Personal-data cases hand off to Privacy Ops
- 7
Lessons learned feed ITSM problems
Workflow
Vulnerability lifecycle
- 1
Finding ingested
- 2
Prioritised and owner assigned
- 3
Remediation ticket created
- 4
Fix reported and rescan verifies
- 5
Exceptions approved with expiry; reappearing findings reopen
Workflow
Access review campaign
- 1
Scope, population, reviewers and schedule defined
- 2
Entitlements snapshotted
- 3
AI recommendations added
- 4
Reviewers decide with reminders and escalation
- 5
Revocations executed and confirmed
- 6
Hash-sealed evidence pack sent to GRC
AI
AI skills and Digital Employees
Alert triage
Severity and disposition proposals with cited rationale.
Access recommendations
Reasons per access item; the reviewer always decides.
Phishing verdicts
Evidence-backed verdicts and similar-message search.
Vulnerability ranking
Prioritisation with explanations and ticket creation.
Stakeholder notification drafts
Drafts for leadership, employees, customers and regulators, sent only after approval.
Digital Employees that use this module
- AI Security Alert Triage Analyst
- AI Access Reviewer
- AI Phishing Report Analyst
- AI Vulnerability Manager
- AI SRE On-Call Assistant
They act through the same governed Actions as people; risky steps wait for approval.
Frequently asked questions
Do we need to replace our security tools?
No. Security Center ingests alerts and findings from tools such as Wazuh, Microsoft, Google, Qualys and Tenable and adds context and workflow.
Can the AI close alerts or revoke access by itself?
It proposes. Analysts and reviewers decide, and higher-risk Actions follow approval rules. Regulatory submission is always human.
Does it store raw logs?
No. It stores alerts and cases, not raw log streams.
Is CERT-In support legal advice?
No. Classification lists, clocks and report fields are configurable templates. Verify requirements with counsel.
See Security Center in your workflow
Tell us about your team and the outcomes you want. We will walk you through the apps, the Digital Employees and the plan for your industry.