A security operations centre does not fail for lack of alerts. It fails because it has too many, each scored on its own, and the ones that matter are indistinguishable from the ones that do not. A DNS anomaly on one host is low severity. A new scheduled task on another host is low severity. An outbound connection to infrastructure first observed yesterday is medium. Individually they are triaged, deprioritised, and closed. Together they are a kill chain.
Scoring the chain, not the event
Monolith reasons across signals rather than within them. It maintains a live model of the estate — assets, identities, flows, exposed services — and when a signal arrives it asks what that signal would mean if it were one step in an attack. Then it looks for the adjacent steps.
A phishing attachment opened on a workstation. Two minutes later, a scheduled task created on the same workstation. Nine minutes later, LDAP enumeration of more than a thousand directory objects. Then SMB to a file server using a credential that workstation had no business holding. Then an outbound connection to an address no one in the organisation has ever reached before.
Five events, each of which would have been closed as low or medium severity in isolation. Assembled, they are initial access, persistence, discovery, lateral movement and attempted exfiltration — a textbook intrusion, reconstructed and scored as a whole in a few seconds, with containment staged: isolate the workstation, revoke the session, block the egress.
Why seconds matters
Reconstruction speed is not a vanity metric. An attacker who has reached the lateral-movement stage is minutes from their objective. A detection that arrives after a human analyst has worked through a queue to find the first signal arrives too late to change the outcome.
Monolith inferences locally — on the appliance or in your own cloud tenancy — so there is no API queue, no rate limit and no third-party latency between the first signal and the reconstructed path. The chain above is assembled in roughly four seconds from the final signal.
Correlated across the evidence an attacker cannot avoid
The chain is built from three evidence planes an intruder has to touch:
- Identity — authentication events, session creation, privilege use, credential anomalies.
- Endpoint — process execution, persistence mechanisms, file and registry changes, agent telemetry.
- Network — flows, DNS, egress, lateral connections, protocol anomalies.
An attacker can evade one plane. Evading all three while still accomplishing anything is extraordinarily difficult, which is why cross-plane correlation produces true positives where single-source detection produces noise.
Every link is evidence
The reconstructed path is not an inference the analyst has to re-derive. Each step in the chain is written to the tamper-evident record with its source evidence, timestamp and the reasoning that connected it to the next step. When the incident is reviewed — internally, by a regulator, by an insurer — the chain is the report.
What changes for the SOC
Analysts stop triaging events and start adjudicating decisions. Instead of a queue of two thousand alerts to work through, the team receives a reconstructed true positive with severity, blast radius and staged containment, and makes one call: approve. For organisations without a 24-hour SOC, that call can be delegated to pre-approved autonomy for defined classes of attack path, so containment happens at 03:00 whether anyone is awake or not. The number the board sees is mean time to detect, and it is measured from the first signal to a verified true-positive verdict, not to the first alert someone has yet to read.
How the same engine rehearses attack chains against your digital twin before they happen: how the simulations actually run.
Frequently asked questions
How does Monolith reduce false positives?
By refusing to score events in isolation. A single anomalous event is retained as context rather than raised as an alert; it is only promoted when it forms part of a coherent sequence across identity, endpoint and network evidence. The output is a reconstructed chain with a verdict, not a stream of individually-scored events.
How fast is attack path reconstruction?
Typically seconds from the final signal, because inference runs locally with no external round trip. The example chain above — five stages from initial access to attempted exfiltration — is assembled in about four seconds.
Can it detect an attack it has never seen before?
It does not depend on a signature for the whole chain. It reasons about what each step would mean within adversary tradecraft generally, so a novel combination of known techniques is reconstructed the same way a textbook one is. Entirely novel techniques are picked up through behavioural deviation from the estate's baseline.
What happens after a true positive is identified?
Containment is staged — typically host isolation, session revocation and egress blocking — and presented for approval with the full chain as evidence. If the attack path falls into a class you have pre-authorised, containment executes immediately and you are notified of the outcome.
Does this replace a SIEM?
It replaces the part of SIEM operations that drowns teams: event-by-event triage. Monolith can consume telemetry a SIEM already collects, and writes its reconstructed chains and actions to the evidence store, which can be forwarded to an existing SIEM for retention and reporting.