Step 1
Vantage finds authorized exposure.
Continuous validation produces OCSF Security Findings scoped to the workspace and approved scan policy.
- Safety Gate before active scans
- Signed reports per tenant
- Feeds Sentinel correlation
← All resources
Learn / platform flow
How it works
Vulnerability → case → remediation across Vantage, Sentinel, Reflex, approval, and Comply.
Overview
From finding to evidence and one governed chain.
Vantage surfaces exposure, Sentinel correlates alerts, Reflex stages response, and Comply maps live evidence and with approval gates throughout.
Presentation flow: Vantage finds a critical issue as an OCSF Security Finding → Sentinel correlates related alerts → Reflex auto-creates a case → analyst approval with staged response if destructive → Comply maps scan and case as live control evidence.
Deep dive
Five lenses on how it works.
Step 2
Sentinel correlates related alerts.
Tenant-scoped indices normalize events in OCSF and build entity timelines analysts can trust.
- Hybrid Splunk connector path
- AI-drafted rules and human approved
- Jurisdiction overlays
Step 3
Reflex opens a governed case.
Playbooks are proposed and not auto-fired and with Kanban stages from new through resolved.
- Dual approval for isolate and block
- Dead-letter queue with audit
- OCSF triggers from Sentinel
Step 4
Analyst approves staged response.
Destructive actions wait for two distinct owner/admin approvers before execution.
- Policy Engine fail-closed
- No fake completed states
- Connector paths stay governed
Step 5
Comply records live control evidence.
Scans, cases, and approvals map to frameworks as continuous proof and not point-in-time exports.
- SOC 2, ISO 27001, PCI mappings
- Regional packs: DORA, RBI, MAS
- Exportable evidence packs
Flow
Finding to evidence.
Step 1
Vantage
Scan finds a critical issue → OCSF Security Finding
Step 2
Sentinel
Correlates the finding against related alerts
Step 3
Reflex
Auto-creates a case from the OCSF trigger
Step 4
Approval
Analyst approves playbook → staged response if destructive
Step 5
Comply
Maps the scan and case as live control evidence
More resources
Keep exploring.
FAQs
Answers grounded in the Axix Oryx customer presentation and platform, MSSP, production, air-gap, and pricing.
Architecture
One console. One control plane. Shared OCSF data language across modules.
Why Axix Oryx
Seven pillars and the problem table from the customer presentation and tool sprawl to quantum uncertainty.Discuss how it works with the Oryx team.
A guided walkthrough scoped to your SOC, compliance, and production footprint and not a slide deck.