Reference
Technical reference for how Hal works: how an event becomes a verified conclusion, how much history Hal can recover, how to confirm a report is genuine, and what the terms in these docs mean.
Detection Pipeline
Every minute, your tenants generate far more log activity than any team could read. Most of it is routine.
OpenGlossary
The terms below appear throughout Hal’s documentation, portal, and reports.
OpenRecovery Windows
How far back Hal reads when a source is first connected, how he catches up after a gap, and what happens to the events while a credential is failing.
OpenReport Verification
Every security report Hal produces is a cryptographically signed PDF.
OpenSee what Hal surfaces on your own clients.
No deck. Ask us anything first. When you want to see Hal on your own tenants, we sign a short evaluation agreement and stand up your instance; you connect one tenant, Hal watches it for 14 days, and we walk you through what he found.
- 01You ask us your questions. No deck, no demo dataset.
- 02You sign a short evaluation agreement, and we stand up your own instance.
- 03You connect one tenant from your own admin console. Hal watches it for 14 days.
- 04We walk through what he found. Keep going month to month, or revoke the scopes yourself and stop.