Parallax coordinates deception capabilities, deterministic decisions, telemetry and response inside a record your team can inspect from beginning to end.
Operations join a threat profile, rules of engagement, scenarios, narratives, assets and closure criteria. ATT&CK and Engage are working vocabularies, not decoration.
Extract groups and techniques from reports, then present suggestions for operator review. Suggestions are never applied automatically.
Use asset criticality and technical identifiers to recommend where a capability belongs without hiding the reasoning.
Find narrative gaps, unsupported capabilities and inconsistent assumptions before anything reaches the environment.
Condition-action rules are readable YAML. Rules of engagement, capability scope and cascade limits are checked before every action.
Events are normalised into telemetry and indicators, while the shared SOC inbox preserves the evidence behind acknowledgement, assignment, grouping and resolution.
Plugin and external events become queryable records and IoCs without erasing where they came from.
Acknowledge, assign and resolve with referenced events and a separate audit trail for human actions.
Map planned effects to evidence from the same operation and capability, then expose misses instead of hiding them.
Export the closing report and machine-readable evidence without locking the result inside Parallax.