Security Investigation

Turn security alerts into evidence-backed investigations.

Analysts jump between the SIEM, identity, endpoint and asset tools to decide whether an alert matters. Deepin can gather that context into one case, reason over it and propose a response for a person to approve.

Bring us a case Where we are
Exploring
SEC-2026-0930 · Internal network investigationAwaiting approval
TriggerIn three days, 5 computers in the same unit tried to connect to more than 100 internal addresses on more than 140 different ports3 days of logs · not a single alert raised
VPN logsInternal firewallOrg chartServer list
Behavior measured · 22 people in one unit, 3 days010100200010100300Ports triedInternal addresses triedThe unit's normal · 17 people5 computers39× the normal address countUnit employee: 0 addresses, 1 portsUnit employee: 1 addresses, 2 portsUnit employee: 1 addresses, 2 portsUnit employee: 1 addresses, 1 portsUnit employee: 2 addresses, 3 portsUnit employee: 2 addresses, 2 portsUnit employee: 2 addresses, 1 portsUnit employee: 3 addresses, 3 portsUnit employee: 3 addresses, 3 portsUnit employee: 3 addresses, 2 portsUnit employee: 3 addresses, 1 portsUnit employee: 4 addresses, 4 portsUnit employee: 4 addresses, 2 portsUnit employee: 4 addresses, 1 portsUnit employee: 5 addresses, 3 portsUnit employee: 5 addresses, 2 portsUnit employee: 6 addresses, 4 portsFlagged computer: 104 addresses, 142 portsFlagged computer: 112 addresses, 155 portsFlagged computer: 118 addresses, 163 portsFlagged computer: 125 addresses, 176 portsFlagged computer: 131 addresses, 188 ports
The other 17 people in the unitThe 5 flagged computers
  • Network91% of the attempts were blocked; with no known attack signature, no alert firedInternal firewall

FindingThe behavior sits in the computers, not the people: trying more than a hundred ports one after another is not something anyone does by hand. Shared software on these five machines is scanning the internal network. The firewall is stopping it for now, but nobody knew what it was.

Review the software on these 5 computers · ask the desktop team

Send to analystApprove
Illustrative case; the organization, people and figures are fictional.

The problem

The logs are collected. Reading them takes time.

Firewalls, VPNs, sign-ins and computers produce millions of log entries every day. They are stored, but nobody has the time to read them all, and what matters gets lost in the crowd.

Not enough time

Understanding a single alert means opening five different systems. An analyst's day ends after a handful of alerts.

What matters slips through

An entry that needs attention sits among thousands of ordinary ones and goes unnoticed.

One incident, many alerts

Alerts about the same incident arrive separately. Working out which ones belong together takes hours.

Silent failures

A service fails for days, monitoring checks the wrong place, and nobody notices.

The difference

Rules catch what is known. Deepin sees what is unusual.

Every security rule describes an attack someone has already seen. However long the list gets, what has not been described yet is not on it. That is why Deepin learns what normal looks like, not what attacks look like.

With rules

Looks for what is described

  • Known malwarealert
  • Blocklisted addressalert
  • Known attack patternalert
  • Behavior nobody has described yetsilent

A new threat stays invisible until someone writes a rule for it.

With Deepin

Sees what departs from normal

  • Servers the team uses every daynormal
  • Working hours and usual computersnormal
  • What everyone in the unit doesnormal
  • A server nobody else goes tocase

Even when a behavior has no name yet, it becomes visible the moment it departs from normal.

What it investigates

From an alert to a case you can act on.

Nothing new to install. Deepin reads the logs your systems already collect and joins them with what your organization already knows: which server an address belongs to, whose account it is, which team they work in.

Investigates
  • Firewall logs
  • VPN logs
  • Sign-in logs
  • Web application logs
  • Endpoint protection logs
Joins with
  • Server list
  • Network map
  • Network devices
  • Org chart
  • User and HR records
Delivers
  • Related alerts in one case
  • Comparison with colleagues in similar roles
  • A check for a reasonable explanation
  • The original log entries behind every claim
  • Day-by-day activity for each person
  • A map of traffic between network zones
  • Mapping to known attack techniques
  • The next step and who to ask

How it works

Every suspicion, the same questions.

Deepin does not run a list of rules. For every suspicious situation it asks, in order, the questions an experienced analyst would ask, and leaves the decision to a person.

  1. Logs

    The logs your systems already collect are read; nothing is changed.

  2. Identity

    Addresses become servers, accounts become people and teams.

  3. Question

    Did this person go somewhere nobody on their team goes?

  4. Comparison

    How many people do the same? What everyone does is not suspicious.

  5. Reasonable explanation

    An update, a test, a monitoring tool? That is checked first.

  6. Case

    Alerts about the same incident come together in one file.

  7. Human decision

    An analyst approves, rejects or takes it further.

  8. Evidence

    Every number in the case is backed by the original log entries.

What it finds

It finds what raises no alert.

Each case type answers one question. Deepin shows why an entry that looks ordinary on its own matters, by asking who, in which team, and to which server.

A group that stands apart

A few people in one unit behave differently from their colleagues. Kept separate from a single person's oddity.

VPN · firewall · org chart

Where nobody else goes

Someone reaches an internal server that nobody in the same role ever uses. Trying and reaching are counted separately.

VPN · network map

Mapping the internal network

Connection attempts to hundreds of addresses and ports in a short time. Told apart from a user who is simply busy.

VPN · internal firewall

An account that suddenly becomes admin

Being added to an admin group, the first admin sign-in and reaching a new system are looked for in order. A single event does not open a case.

Sign-in logs · VPN

A leaver's account still open

Accounts that HR records show as having left, but that still sign in.

HR records · sign-ins

Internet traffic reaching inside

A request that should stay in the internet-facing zone reaching the internal network. Every crossing on one map.

Firewalls · network map

Endpoint protection alerts

Alerts from endpoint protection, with the user and the computer attached. Your own attack simulations and bulk software rollouts are kept apart.

Endpoint protection · sign-ins

The failure nobody noticed

A service returning errors for days, or monitoring that checks the wrong place, without a single alert.

Web application logs · server list

With your existing systems

Not instead of it. On top of it.

Your log collection system (SIEM) keeps collecting logs and catching known attacks. Deepin picks out what is worth a look and turns it into a case.

TodayWith Deepin
What it doesCollects and stores logs, catches known patternsJoins logs with what your organization knows and prepares a case file
New behaviorInvisible unless someone wrote a ruleEach person is compared with their team, so the difference shows
AlertsOne alert per event; the analyst connects themAlerts about the same incident in one case
False alarmsThe analyst weeds them out one by oneEvery case is checked for a reasonable explanation first
Silent failuresInvisibleA service failing for days becomes a case
EvidenceThe analyst writes queries to find itThe original log entries behind every number, ready

Evidence

Not a score. Three clear answers.

Every case answers the same three questions and says what to do next. Behind every number sit the original log entries, never edited or shortened.

For
Banks and regulated organizations
Teams
Security operations and information security
Together with
System, network and IT operations teams
In every case
  • How many sources confirm it?How many separate systems' logs show the same thing
  • How many people do this?How common the behavior is in the team and across the organization
  • Is there a reasonable explanation?An update, a test, a monitoring tool: was it checked, was it found
Numbers match the logs
137 blocked requests in the case=137 lines in the logs
Case with evidence ready→Analyst decision

Trust

Runs inside your organization. No log ever leaves.

Deepin runs on your own server. It only reads logs and never touches the settings of your security systems. The review screen does not connect to the internet.

  1. 01

    Source

    Every case is tied to the system and the log entry it came from.

  2. 02

    Original entries

    The log entries behind a case are kept exactly as they are; not a character is changed.

  3. 03

    Numbers add up

    Every number on screen is checked against the logs; a case that does not match is flagged.

  4. 04

    The base of every rate

    When a rate is shown, it also says out of how many people.

  5. 05

    Decision

    Deepin makes a recommendation; a person always decides.

  • Installed inside your organization
  • No internet connection needed
  • Read-only, changes nothing
  • Sends no data out
  • Original entries kept
  • Numbers checked against logs
  • Every change recorded
  • A person decides
Your logs stay with you.

Not a single log left the organization during the first trial either. What we carry from one organization to the next is case types and review methods, never your logs.

Where we are

Exploring, first tried at one organization.

Exploring

The first trial of deepin.security ran inside a bank's own environment, on real logs. Firewall, VPN, sign-in, web application and endpoint protection logs were read together with the bank's server list, network map and org chart.

Before calling it a Space, we want to see the same cases appear at a second organization. If your team investigates alerts by jumping between many tools, we would like to see how the work is done today.

How a Space is earned →

Explore the investigation screen yourself, with fictional data: deepin.security demo ↗

deepin.security

Your logs are being collected. Who tells you which ones to look at?

Tell us how your team works today. We will show you what Deepin can find in your own logs, without a single log leaving your organization.

info@deepin.space

Deepin

Get to know Deepin technology.

deepin.security is part of Deepin. Deepin builds agents that investigate business cases, show the evidence and wait for a person to approve the decision.

See the other Spaces, the Harness underneath and how it all works on the Deepin home page.

Explore Deepin