OBSIDIA — Technical-Executive Brief v8.0

01 · Executive Summary

What is OBSIDIA?

OBSIDIA is an operational security platform (SOC-as-a-Service) that brings threat detection, artificial intelligence analysis, automated alerting and incident management together in a single solution. Built for organizations that need enterprise-grade visibility in Latin America — MX, BR, CO, AR, CL and the rest of the region.

Continuous Detection

24/7 watch over security events across the whole infrastructure, with automatic correlation and priority set by real risk, not by volume.

AI Analysis — MITRE ATT&CK

Every relevant alert is analyzed to identify the MITRE tactic, the potential impact and the recommended remediation, with full context. During an active incident the analyst can request a tailored response playbook.

Alerts that reach whoever operates

Every relevant alert is delivered to whoever operates that client, through their own channel, with a daily summary and spike detection. A daily check confirms the alert would go out before it is needed.

Incident Management

Automatic creation of enriched tickets in osTicket, Jira Service Management or ServiceNow. Every incident is documented, assigned and traceable with full AI analysis.

Reports and evidence

Live monitor with risk indicators, plus service and technical reports per period — one sheet per incident, with severity, MITRE tactic and response times — ready for the board or an audit.

Network visibility and VPN access

Perimeter traffic aggregated per minute: allowed and blocked sessions, bandwidth, destination countries and applications in use, without storing raw logs. Plus who connects over VPN, from which country and with which address: access granted after several failed attempts raises an immediate alert and opens a ticket.

02 · Architecture

How it fits what you already have

OBSIDIA is a layer of intelligence over the security the client already has: it does not replace their tools, it receives their events, unifies them into a single format, analyzes them and turns them into actionable incidents that reach the right team through the right channel. All components run in isolated containers, and the client decides where their information resides.

03 · Operation Flow

From event to incident in 6 steps

OBSIDIA automatically orchestrates the entire detection-response cycle. The SOC team receives already-enriched tickets and actionable Telegram alerts, without manual correlation work.

Collection — the sources you already have

Firewalls and perimeter gear, servers and workstations, cloud services and any SIEM or EDR already in use send their events to OBSIDIA. The usual protocols are supported — syslog, API and webhooks — without changing how the client operates.

Normalization — everything in one format

Events from different origins end up in a common format and repeats are discarded, so the same fact is not counted — or alerted — twice. Adding a new source does not force anything built before to be redone.

AI Analysis — MITRE ATT&CK + Kill Chain

Depending on the contracted plan, alerts from a given severity go through the AI engine: it identifies the MITRE ATT&CK tactic and technique, the kill chain phase, the likely impact and the recommended remediation, with the full context of the case.

Automatic enriched ticket creation

A ticket is opened with a structured subject — severity, rule and the device that originated the alert — and a body carrying the event data, the full AI analysis, the MITRE context and the remediation steps. Works with osTicket, Jira Service Management and ServiceNow.

Alerting and escalation — to whoever operates that client

The alert goes out through the channel of whoever operates that client, not to a generic list: real-time alerting, SLA watch, notice when equipment stops reporting and volume spike detection. If nobody responds within the plan's time, the case escalates to the next level.

Follow-up, closure and evidence

Every event is recorded and shows up on the monitor as it happens. From there it is marked Acknowledged, Resolved or False positive: the action is audited and closes the ticket in the service desk. All of it feeds the service reports and the monthly executive summary afterwards.

04 · Automation

What the platform does on its own

Each automation answers a concrete operational question: it fires on a defined condition, runs the action without human intervention and leaves a measurable result. All of them are configurable per client.

Condition → OBSIDIA evaluates and adds context → Runs the action → Telegram · ticket · escalation

Available today

Automation	Fires when…	Automatic action	Result
SLA monitor Live	An open alert exceeds the plan's response time (8 h / 4 h / 2 h).	Notifies whoever operates that client and triggers the escalation.	No alert misses its SLA without someone knowing.
Devices not reporting Live	A device stops sending a heartbeat for the configured interval.	Identifies the device, its last contact and raises the alert; internal components are excluded to avoid noise.	Blind spots found in minutes, not days.
Daily summary Live	Every day, at the configured time.	Consolidates total alerts, severity breakdown, review rate and response times.	A daily report with no manual preparation.
Spike detector Live	Alert volume exceeds the client's historical average.	Flags the anomaly and notifies for immediate review.	Early detection of coordinated attacks or misconfiguration.
False positive rate Live	Over a configurable time window.	Calculates the false positive rate per client and per rule.	Continuous tuning of rules and thresholds: less noise every month.
Indicator enrichment Live	The incident contains IP addresses, domains or files.	Looks up their reputation in external sources and attaches the result to the ticket.	The analyst decides with context, without investigating elsewhere.

04 · Automation

What the platform does on its own (continued)

Automation	Fires when…	Automatic action	Result
Playbook generator Live	The analyst requests it during an active incident.	The AI engine returns a containment, investigation and documentation guide.	A standard response in minutes, not dependent on individual experience.
Service and compliance reports Live	At the close of the period or on request.	Generates the service report, the technical one with a sheet per ticket, and the monthly executive summary.	Evidence ready for the board and for auditors.
Capacity control Live	Monitored assets or log volume approach the contracted limit.	Compares firewalls, servers and devices against the plan, and warns at 80 % of the ingest quota.	Orderly growth, with no assets out of coverage and no surprise overage.
Alert routing Live	Any relevant notice: a new ticket, an incident or suspicious access.	Delivers it to whoever operates that client through their channel, and a daily check confirms the alert would go out.	No notice is left without a recipient.

Next releases

Automation	Fires when…	Automatic action	Result
Tiered escalation Roadmap	Nobody attends a case within the defined time.	Tier 1 → tier 2 → tier 3 chain configurable per client, with waiting times between levels.	If nobody responds, the next level finds out automatically.
Slack and Microsoft Teams Roadmap	Any notice that goes out today over Telegram or email.	Relay to the channel the client already uses, configurable per alert type.	The notice arrives where the team already works.
Ticket auto-assignment Roadmap	A new case is created.	Assigns it by alert type, severity, affected asset or MITRE tactic.	Less time to first contact.

05 · AI Playbooks

Guided Incident Response

When an active incident is detected, the SOC analyst can request a playbook generated by the AI engine from the Dashboard. The playbook is immediately actionable — not a generic guide, but a response tailored to the specific detected threat.

🔍 Identification and Context

The AI engine receives full incident context: triggered rule, affected device, MITRE tactic, severity and related events in the time window. No client data exposed in shared environments.

🛑 Immediate Containment

Containment steps specific to the detected threat: network isolation, session revocation, process or account blocking. Ordered by minimum operational impact.

🔬 Investigation and Analysis

Forensic investigation guide: artifacts to collect, logs to review, recommended tools and key questions to determine the actual scope of the incident.

📄 Documentation and Closure

Incident documentation structure, closure criteria, post-incident remediation actions and control improvement recommendations to prevent recurrence.

Security note: Playbooks generated in the OBSIDIA shared environment use exclusively generic contextual threat information (MITRE tactic, event type, severity). They never include client internal hostnames, private IPs, usernames or credentials — ensuring that the generated content is safe to operate in a multi-tenant infrastructure.

06 · Technical Capabilities

Threat Coverage — MITRE ATT&CK

OBSIDIA detects and correlates threats mapped to the MITRE ATT&CK Enterprise framework. Includes native support for Latin American regulatory frameworks.

MITRE Tactic	Detected Techniques	Severity
Initial Access	SSH/RDP Brute Force, public exploit	Critical
Execution	Shell commands, malicious scripts	High
Persistence	Crontab modification, services	High
Privilege Escalation	sudo abuse, SUID/SGID	High
Defense Evasion	Log clearing, rootkits	Medium
Credential Access	Password spraying, hash dump	Critical
Lateral Movement	PsExec, SSH tunnels	High
Impact	Ransomware patterns, data deletion	Critical
Compliance (SCA)	CIS Benchmarks · PCI-DSS · LGPD · ISO 27001 · CNBV · INAI	Info

System Specifications

Traffic visibilityPer-minute aggregation · raw logs not stored

GeolocationLocal database · no third-party lookups

Log retention15 / 30 / 60 days by plan

Supported sourcesFirewalls, servers, cloud, existing SIEM and EDR

AI AnalysisSeverity analyzed according to plan

Automations running10 in production · 3 in development

Alert channelsTelegram and email · Slack and Teams in development

Service desksosTicket · Jira · ServiceNow

07 · Plans & Licensing

Contracting options

All plans include the complete platform — detection, AI analysis, tickets, monitor and the basic automations. Each plan is a package with included capacity (firewalls, servers and devices); anything beyond it is billed per device, without changing plans. Contract size defines the plan, which raises the response SLA, retention and automation. Service live in less than 24 hours from signature. Initial term of twelve months with automatic renewal; either party may choose not to renew with thirty days' written notice.

Starter · SMB

Quote / month

3 FW/routers included 20 servers 100 devices Overage billed separately SLA 8h 15-day retention

Real-time detection 24/7
AI Analysis — Critical severity
Correlation with 5-alert threshold
Operational SOC dashboard
Automatic osTicket tickets
Service reports per period
SLA watch, devices not reporting and volume spikes
Email support

Pro ★ Most popular

Quote / month

6 FW/routers included 40 servers 200 devices Overage billed separately SLA 4h 30-day retention

Everything in Starter plan
AI Analysis — High + Critical
Correlation with 3-alert threshold
Real-time Telegram notifications
Daily, weekly and per-ticket technical reports
Daily summary and false positive rate
Jira / ServiceNow integration (one-time fee)
CIS Benchmarks · PCI-DSS · ISO 27001
Email + Telegram support

Enterprise

Custom / year

10 FW/routers included 70 servers 350 devices Overage billed separately SLA 2h 60-day retention

Everything in Pro plan
AI Analysis — fully configurable
Customizable correlation
On-demand AI playbooks included
Every automation, including new ones
Multi-tenant / multi-site
Custom detection engineering
Priority technical support

07 · Plans & Licensing

Contracting options (continued)

Capacity included per plan

What each package includes. Anything beyond it is billed as per-device overage; an HA cluster counts as one firewall.

Type	Starter	Pro	Enterprise
🛡️ Firewalls / routers (logical)	3	6	10
🖥️ Servers	20	40	70
💻 Devices / workstations	100	200	350
🔒 WAF, databases, EDR, vulnerabilities	Separate	Separate	Separate
☁️ O365 tenants · SASE consoles	Per tenant	Per tenant	Per tenant
➕ Beyond what is included	Overage	Overage	Overage

Add-ons and additional services

Overage

Firewalls, servers or devices beyond what is included, without changing plans.

Traffic panel

Real-time sessions, VPN, heat map and behavioral signals.

Extended AI analysis

AI enrichment for medium and high severity alerts too.

On-demand AI playbooks

A response playbook for a specific alert. Included in Enterprise.

Monthly executive reports

Monthly security posture report for leadership.

Extended retention

+30-day blocks on top of the plan retention.

Integration with your SIEM

Send or receive events from an existing SIEM. One-time fee.

Integration with your service desk

Jira, ServiceNow or another ticketing system. One-time fee.