One foundation.
Every security decision.
Most "platforms" are acquisitions wearing one login page. XSecurity One is a single system: one canonical data model, one security graph, one evidence layer — and every module reads and writes the same truth.
A platform you can draw on a whiteboard.
Eight planes, one direction of trust. Signals flow up; every plane above enriches — never bypasses — the canonical record beneath it. That's what makes evidence trustworthy and response auditable.
Role-aware console, dashboards, full API surface.
Regulatory clocks, evidence packages, sign-off.
Approvals, blast-radius checks, expiry, rollback.
Identities, assets, sessions, subscribers, data — joined.
Rules-as-code, behavioral analytics, incident assembly.
IOC/IOA and sector context inside the investigation.
One schema, lineage preserved, retention tiers.
Endpoint, network, identity, cloud, telecom, AI telemetry.
The nine services every module stands on.
OneCore is not a product you buy separately — it's the reason the products behave like one platform.
Every source normalized once into one schema with source lineage.
Entities and relationships — the connective tissue of every incident.
Append-only, hash-chained records ready for auditors and regulators.
Correlation, timeline, blast radius, ownership and state.
Strict tenant boundaries and role-scoped access at the data layer.
The guardrail machinery every response action must pass through.
Hot, warm and archive tiers with honest cost visibility.
Who saw what, who changed what, who approved what — always.
Everything the console does, your automation can do — with the same guardrails.
{
"event_id": "evt-01J9…",
"tenant": "tn-fiber-ops",
"class": "network.flow.anomaly",
"entities": { "subscriber": "SUB-9F42E1", "asset": "cpe-88:1f…", "session": "rad-77021" },
"observed": { "beacon_interval_s": 297, "dst": "185.x.x.24" },
"lineage": { "source": "ipfix.bng-pune-02", "parser": "ipfix@4.2.1", "raw_ref": "blob://…" },
"evidence_ref": "ev-114"
}
Alerts tell you something happened. The graph tells you what it means.
When a detection fires, the graph answers the questions that matter within seconds: who is this identity, what can it reach, which subscriber is behind this session, what else did this process touch — and how far does the damage actually extend.
Seven gates between an idea and an action.
Response automation fails when it's given unsupervised authority. Every XSecurity One action — human or AI initiated — passes the same pipeline. No exceptions, no side doors, not even for administrators.
An analyst, playbook or AI proposes an action against a specific incident.
The action is bound to explicit targets — this subscriber, this asset, this rule.
The graph estimates who and what would be affected before anything moves.
A human with the right role approves — or the action stops here. Full stop.
A signed, time-limited command executes with automatic expiry.
Every action ships with its reversal — one click to restore.
Proposal, approval, execution and outcome land on the incident as evidence.
Runs where your mandate says it must.
Managed by us, processed and stored in India.
Your datacenter, your keys, your upgrade cadence.
Hot data on-prem, coordination in the cloud.
Fully offline for defense and critical infrastructure.
Integrates with the estate you already run.
Syslog, IPFIX/NetFlow, SNMP, APIs and native connectors — including a first-class, signed bridge into XIMS for the ISP world. Connector availability follows the release register; we list what's real.
MikroTik, firewalls, routers/switches, BNG, OLT/ACS platforms.
Directory services, cloud providers, workload telemetry.
Purpose-bound, minimal, audited — subscriber context without OSS/BSS duplication.
Walk the architecture with the people who built it.
A working session on your scenario — from canonical event to guarded action to evidence.