Synthetic Demo

Three fictional SOC scenarios show how ATA removes sensitive identifiers while preserving investigative context for analyst-led triage. Everything below runs locally in your browser with synthetic data—no account required.

Start Demo

Jump to the interactive walkthrough on this page.

Interactive Public Demo

Synthetic SOC Investigation Walkthrough

Run a browser-local demonstration with fictional alerts. This public demo uses the real client sanitizer and deterministic simulated analysis. It does not sign you in, call live AI providers, contact cloud backends, or save cases. The full authenticated ATA application remains separate.

1. Raw alert2. Sanitize3. Simulated analysis

Synthetic Raw Alert

Microsoft Defender for Endpoint · Medium

Demo alert - fictional training data only.
Detection: Suspicious PowerShell Activity
Account: admin.miller
Device: WSUS-SRV01
Source IP: 10.20.15.8
Destination URL: https://support.vendor-example.com/patch/catalog
Maintenance window confirmed. Expected script path and process chain observed. No suspicious follow-on activity.

Next: run local sanitization to replace identifiers with stable placeholders using ATA's client sanitizer.

Privacy Process

Original Identifier -> Privacy Placeholder -> Investigative Context

ATA keeps identity relationships with placeholders and preserves security meaning with privacy-safe context labels such as user role, asset role, and network trust—without sending raw identifiers to analysis.

Secondary

Presenter Talk Track

Expand

Remove sensitive identifiers while preserving investigative context.
AI only receives sanitized text and privacy-safe context labels.
Context labels describe roles, trust, and asset meaning without raw values.
Analyst remains the final decision maker.
VPN context can explain a signal, but user validation is still required.

Secondary

Scenario Reference

Titles, sources, and severity only—use the interactive runner above for raw alerts and analysis.

Expand

Benign Positive

Approved Administrative PowerShell Maintenance

Approved administrative activity

Source: Microsoft Defender for Endpoint
Severity: Medium

Suspicious Activity

Suspicious PowerShell Execution from Office

Office-spawned encoded PowerShell

Source: Microsoft Defender for Endpoint
Severity: High

Needs More Evidence

Impossible Travel Authentication with VPN Context

Impossible travel with VPN context

Source: Microsoft Entra ID
Severity: High

Step 1

Raw Alert

Start with synthetic or approved test alert data.

Step 2

Sanitize

Replace identifiers with consistent placeholders.

Step 3

Validate Privacy

Server-side validation rejects obvious raw identifiers.

Step 4

AI Analysis

Analyze only sanitized text and privacy-safe context labels.

Step 5

Analyst Decision

The analyst reviews evidence and approves the final disposition.