# Watch your AI agents.

URL: https://avispa.ai/orbitsoc/

Avispa OrbitSOC

OrbitSOC watches the AI agents you run on Avispa, and runs your SOC.

[Book a demo](https://avispa.ai/book-a-demo/)

- [OrbitSOC Agent Monitoring · Specializes in your Avispa agents: behavioural analytics, agent detections and an automatic pause.](https://avispa.ai/orbitsoc/#monitoring)
- [OrbitSOC Agentic SOC · AI agents run your SOC, from intel to response, and learn from every case.](https://avispa.ai/orbitsoc/#agentic-soc)

![OrbitSOC’s Agent monitoring Home, in the app’s Avispa Light theme: 21 agents in 4 Avispa teams, 3 open detections and 1 agent paused for review, each team’s events per hour, and the detections that need attention.](https://avispa.ai/assets/orbitsoc/home-2560-f4a63893de.webp)

OrbitSOC Agent Monitoring

## Who’s watching the agents?

OrbitSOC is, from outside Avispa, and it pauses an agent when your rules say so.

1. **Connect** · Avispa’s audit sources, metadata only.
2. **Watch** · Behavioural analytics flag anomalies.
3. **Detect** · Rules built for agents, every minute.
4. **Pause** · Automatically on your rules, through Avispa’s API.
5. **Review** · Its work is kept. A person resumes it.
6. **Send** · OCSF to your SIEM, within about two minutes.

**Agent behaviourAnomalous behaviour, hour by hour.**

![Agent behaviour: a heat map of eleven Avispa agents’ events by the hour, with the Network Engineer’s last two hours marked by detections, and its data sent at 15.2 times its usual while the other agents stay near 1×.](https://avispa.ai/assets/orbitsoc/behaviour-1280-ab6c774ff1.webp)

**A detectionWhat happened, why it matters, and the pause it called for.**

![A detection, Agent sent far more than it received, High: 182 MB sent and 6 MB received, 176 MB of it to a host the agent had never used, and a pause of the Network Engineer awaiting a SOC lead’s approval.](https://avispa.ai/assets/orbitsoc/detection-1280-4f54695ec4.webp)

**Access & reachOne agent, and everything its events reached.**

![Access & reach, “What can this agent reach?”: the Network Engineer in the middle, 1,036 events read in 7 days, with a line out to each thing they reached: five tools (storage.upload\_blob 3 times), three MCP servers, its identity and its credential, three pieces of data and three hosts, files.example.net among them. Dashed lines go to a tool and a server it holds but never used.](https://avispa.ai/assets/orbitsoc/reach-1280-7ad9bc00e5.webp)

**Posture & RiskEach agent scored from 0 to 100, and what weighs most.**

![Posture & Risk: agents by risk score, the Network Engineer highest at 63, High, with the five parts of its score and the risk checks failing over the last 30 days.](https://avispa.ai/assets/orbitsoc/posture-1280-a9c87a048e.webp)

OrbitSOC’s Agent monitoring, as it shows an Avispa Enterprise instance.

[Every capability](https://avispa.ai/orbitsoc/agent-monitoring/)

OrbitSOC Agentic SOC

## The Agentic SOC.

An agentic cyber defense platform covering the full SOC loop (intel, hunt, detection, alert, analyze, respond) in a self-improving learning loop. Your people make the calls.

**OrbitSOC** · The SOC loopOne estate case: MFA push fatigue

This stage also covers AI agents today

1. **Intel** · OrbitSOC’s agents: Turns a fresh report into a hunt · Your people: · Approve what enters
2. **Hunt** · AI agents · OrbitSOC’s agents: Hunts daily; scores AI agents hourly · Your people: · Publish the hunt
3. **Detection** · AI agents · OrbitSOC’s agents: A rule fires on the sign-in · Your people: · Deploy new rules
4. **Alert** · OrbitSOC’s agents: Investigates on arrival · Your people: · Runs on its own
5. **Analyze** · OrbitSOC’s agents: A red team attacks the conclusion · Your people: · Confirm or override
6. **Respond** · AI agents · OrbitSOC’s agents: Proposes disabling the account · Your people: · Approve it first
7. **Learn** · OrbitSOC’s agents: Proposes a rule for the missed burst · Your people: · Deploy the new rule

Round again: what the case missed becomes a new rule for your estate

**First time:** caught at the sign-in

**Second time:** caught at the push burst, sooner

- [**Investigations** · One alert, start to finish.](https://avispa.ai/orbitsoc/investigations/)
- [**Hunting and intel** · Build your own hunts.](https://avispa.ai/orbitsoc/hunting/)
- [**Detections and learning** · Detections your SOC lead approves.](https://avispa.ai/orbitsoc/detections/)
- [**Visibility and control** · See what your SOC can see.](https://avispa.ai/orbitsoc/visibility/)

[See a live investigation · (opens orbitsoc.com)](https://www.orbitsoc.com/investigation-storyline?view=storyline)

## See OrbitSOC watch your agents.

[Book a demo](https://avispa.ai/book-a-demo/) · [See Agent Monitoring](https://avispa.ai/orbitsoc/agent-monitoring/)