From signal to response in 7 steps
Every decision KAVACH makes is traceable, explainable and auditable.
Collect 16 Telemetry Collectors
Background daemons continuously observe low-level OS events across processes, sockets, DNS, registry, PowerShell and canary tripwires.
Normalize Async Event Bus & Deduplication
Raw events pass through an asynchronous in-memory bus. Fields are standardised into canonical schemas, noisy heartbeats are deduplicated and correlation IDs stamped.
Detect Deterministic Rules + IsolationForest ML
Each event is evaluated by two engines at once: rules mapped to MITRE ATT&CK and an IsolationForest model over 10 behavioural dimensions.
Correlate Incident Clustering & Kill-Chain Mapping
Alerts are correlated over time across hosts, accounts and network destinations to build a full incident timeline.
Score Hybrid Risk Engine
Rule severity, ML anomaly confidence and threat-intel lookups combine into a transparent, calibrated 0–100 risk score.
Respond SOAR Playbook Execution
Controlled actions fire per security policy — high-impact ones need authorisation, support dry-run and log an immutable audit trail.
Explain Raksha AI Cybersecurity Copilot
Raksha turns evidence, process trees and actions into clear explanations for everyday users and deep forensic summaries for analysts.
One phishing email, followed end to end
This is what the pipeline does with a real-looking attack, second by second.
T1059.001MLT1071CORR14 msDesign choices that make it trustworthy
Nothing in the pipeline is a black box.
Two detectors, not one
Rules catch what is known. ML catches what is strange. An event only escalates when the evidence agrees.
A score you can read
Risk is 0 to 100 and every point can be traced back to a rule, a model output or a threat-intel match.
Humans stay in control
High-impact actions need authorisation, can be rehearsed in dry-run and are fully logged.
Pipeline FAQ
Containment in our reference scenario takes about 14 ms from correlation to isolation.
The hybrid risk engine weighs severity, ML confidence and threat intel together, and shows its working to the analyst.
Ready to see it in action?
Sign in to the operations console or follow the onboarding guide to deploy your first agent.