Skip to content

53,600 AI-swarm attacks. Every one stopped in the kernel. 0 bytes leaked.See the evidence

Solomon OmniMesh · connect, correlate, remediate

Every tool you own, one investigation.

OmniMesh connects the cloud, identity, endpoint, SIEM and ticketing tools you already run, without an agent in their path. It correlates their signals into one case, lets Solomon agents investigate it end to end, and acts back on the same tools when you approve.

Request a pilot See all 35 integrations
Case 1042 · correlated4 sources

  1. Okta09:12:04

    Sign-in from a new country, MFA push accepted

  2. AWS CloudTrail09:14:37

    AssumeRole into prod-admin from 203.0.113.24

  3. CrowdStrike Falcon09:15:10

    Credential-dumping tool on build-07

  4. Splunk09:15:52

    Notable: large upload from build-07 to 203.0.113.24

Correlated on j.doe · 203.0.113.24 · build-07

Account takeover → cloud privilege escalation → exfiltration

One case, one timeline, investigated end to end by Solomon agents.

  • Jira issue SEC-311 openeddone
  • Revoke j.doe's Okta sessionsawaiting approval
  • Contain build-07 in Falconawaiting approval
  • Revoke prod-admin IAM sessionsawaiting approval

Illustration of a correlated case. Names and addresses are placeholders.

Today

Native connectors1
35
categories, from identity to SIEM2
7
for a newly connected tool to start, no restart3
60 s
  1. 1Connectors in the portal's integrations catalog today; the number updates as the catalog grows.
  2. 2Categories in the portal's integrations catalog (INTEGRATION_CATEGORY_DEFS).
  3. 3OmniMesh re-scans active integrations every 60 seconds and starts new ones automatically (Solomon_Platform docs/omnimesh-architecture.md, src/omnimesh/worker.py).

How it works

Connect. Correlate. Investigate. Act.

OmniMesh is the outside view that complements the Solomon eBPF Client: the same pipeline, the same record, now with your SaaS, cloud and security tools in it.

  • Out-of-band ingestion

    • Pulls from each vendor's own API: nothing sits in the path of the tools you run
    • AWS access through cross-account role assumption with short-lived sessions, not static keys
    • Credentials kept in Vault per tenant and never logged

  • One normalized record

    • Every source is normalized to OCSF, like the Solomon eBPF Client's own telemetry
    • Both land in the same per-tenant pipeline and tables
    • Cursors are saved after every batch, so a restart resumes where it stopped

  • End-to-end agentic investigation

    • Solomon agents follow one user, host or IP across identity, cloud and endpoint
    • They query your SIEM in place when they need more: SPL in Splunk, KQL in Sentinel, UDM in Google SecOps
    • Threat intel enrichment from VirusTotal, GreyNoise, AbuseIPDB and Shodan

  • Ticketing and on-call

    • Open and transition Jira issues from the case
    • Pull ServiceNow incidents into the investigation
    • Trigger and resolve PagerDuty incidents; post alerts to Slack and Microsoft Teams

  • Act back on your tools

    • Contain hosts in CrowdStrike Falcon or SentinelOne, lock Macs in Jamf
    • Revoke sessions or suspend users in Okta and Entra ID
    • Block IPs and URLs in Cloudflare, Palo Alto Networks and Zscaler

  • Governed by default

    • Only organization owners or integration admins can connect or change a tool
    • Containment, identity and cloud actions wait for a person to approve
    • The analyst who asked for an action cannot approve it

Remediation

It acts back, with a person in charge.

Investigations end in action, not in a report. Solomon agents propose the next step and OmniMesh carries it out in the tool that owns it: a Jira issue, a contained host, a revoked session, a blocked IP.

Anything with blast radius waits for a human. Host containment, identity actions and every cloud change land in an approval queue, AI agents never count as approvers, and the analyst who asked for an action cannot approve it themselves. Approvals can go to your phone with Solomon XGuard.

Cloud remediation covers AWS (revoke IAM sessions, rotate keys, quarantine instances, block public S3 access) and Google Cloud (disable service-account keys, remove IAM bindings, isolate instances).

Actions OmniMesh can takeexamples

  • Atlassian Jira

    Open an issue, move it through your workflow

    automatic

  • CrowdStrike Falcon

    Contain the host, lift containment

    after approval

  • Okta

    Revoke sessions, suspend the user

    after approval

  • Microsoft Entra ID

    Revoke sessions, disable the account

    after approval

  • AWS

    Revoke IAM sessions, quarantine an EC2 instance

    after approval

  • Cloudflare

    Block an IP or domain at the edge

    after approval

  • GitHub Security

    Revoke a leaked secret

    after approval

Integrations

Native connectors, generated from one catalog.

35 native connectors across 7 categories, from Okta and Entra ID to CrowdStrike, Wiz, Splunk and ServiceNow. Connect them yourself in the VIntercept portal: each one comes with a guided setup, the exact scopes it needs and, where the vendor allows it, a connection test.

The page you are reading and the portal draw on the same catalog, so we never list a connector you cannot connect.

The catalog today35 connectors
  • Identity & Access5
  • Endpoint & Fleet3
  • Cloud & Infrastructure6
  • Network & Perimeter3
  • Threat Intel & Vulnerability6
  • ITSM & Collaboration7
  • SIEM & Log Platforms5
Browse every integration

Solomon platform

The rest of the loop

Let’s stop the swarm, together.

Run Solomon against your own workloads in a guided pilot. We’ll show you the kernel log, the investigation and the approval, on your infrastructure.

Request a pilot Talk to us