Torq

Torq is an AI SOC Platform combining two layers: Hyperautomation — a deterministic workflow engine for building SecOps automations — and HyperSOC — an agentic layer in which artificial intelligence (Socrates) acts as an additional SOC operator. The platform covers the full incident lifecycle: triage, data enrichment, investigation, and response, integrating natively with SIEM, EDR/XDR, IAM, cloud, and threat intelligence systems. Torq provides a native Case Management module as the central source of case information (evidence, timeline, summaries).

Torq is delivered in a cloud-native SaaS model. Workflows are built with no-code/low-code or by describing intent in natural language, which the Socrates module translates into deployable automations and agent configurations. Instructions for the Socrates agent are built in natural language rather than as rigid instructions — this distinguishes them from classic SOAR playbooks. The platform provides a library of integrations and ready-made steps for building automations.

Benefits for the organization:

  • Faster threat response — routine tickets are handled automatically, without waiting for an analyst.
  • Less manual work for the security team — repetitive tasks are performed by the system, people handle the harder cases.
  • Shorter rollout time for new security processes — automations are built faster, without writing and maintaining code.
  • One place with the complete history of every case — easier team collaboration and reporting to management.
  • Ability to handle a higher volume of tickets without growing the team.
  • Full history of decisions made — useful for audit and compliance.

https://torq.io/

Описание на технологията

SOAR/SOC

Case Management - A native platform module serving as the source of events requiring intervention or monitoring (evidence, timeline, case summaries), which simplifies collaboration between analysts at different tiers and reporting to management and audit.

HyperSOC - An agentic overlay in which Socrates acts as the orchestrator coordinating specialized AI agents (HyperAgents): the Runbook Agent (turns natural-language instructions into ready-to-run automations), Investigation Agent (data enrichment and root-cause analysis of an incident), Remediation Agent (executing corrective actions across integrated systems), and Case Management Agent (real-time case tracking and prioritization). Runbooks are semantic in nature — they are instructions for Socrates rather than executable playbooks in the classic SOAR sense, allowing response logic to be modified faster without rebuilding the entire workflow.

Hyperautomation - A deterministic workflow engine (triggers, steps, integrations, webhooks) responsible for repeatable, rule-based operations: event deduplication, data normalization, enrichment, and escalation. This means routine tasks that would otherwise reach Tier-1 are handled automatically, allowing analysts to focus on cases requiring expert judgment.

Полезни файлове