The Pharelis platform
Every module available in the console today, grouped by the five parts of the platform. Each module is available to the roles that need it.
This page lists released modules only. Planned work appears under “Coming next” on the home page.
Security monitoring
From raw telemetry to a closed case, every step is recorded and reviewable.
Sources and intake
Syslog edge, stream connections, Pharelis Collector agents with heartbeat and spool health, uploads and scheduled pull connectors. A log format studio and a visual pipeline designer, tested on samples before use.
Receipts and quarantine
A receipt for every batch, per-record outcomes, parser contracts and a quarantine that keeps each rejected record with its reason.
Detection rules
Rule registry, rule templates, a visual condition builder, sample previews, shadow mode, historical evaluations and two-person promotion.
Threat catalogue and tested coverage
Published threat scenarios with rule variants and field readiness for your data. Coverage separates detections that are installed from those proven to work, and shows the gaps.
Findings, incidents and cases
Findings with version history and bounded evidence samples, incidents that group related findings, cases with owners and response plans, and exportable investigation packages.
Events, hunting and dashboards
Exact search across events, the Pharelis Query Language over events, findings, incidents, cases and the archive tier, and dashboards of saved queries.
Entities and attack paths
Users, service accounts, hosts, addresses and applications seen in events or imported from an inventory, their graph, silent assets, and attack paths to your critical assets.
Behaviour anomalies
Days on which an account or host behaves unlike its own history or its peers, with the reasons for the score and tuning controls.
Non-human identities and deception
Service accounts, managed identities, keys, OAuth applications and AI agents with their normal behaviour and drift; decoy accounts, keys, document beacons and DNS canaries that trip a built-in rule.
Threat intelligence
Feeds from partners, TAXII servers or uploads, watchlists for deny, allow, VIP and critical-asset values, threat matches and retro-hunts that change nothing until you choose.
Response actions and playbooks
Catalogue actions through the action broker, a trust ladder of policies with shadow mode, approvals in the console or by signed link, versioned playbooks and “Was this you?” questions to users.
Detection migration
Upload IBM QRadar or Microsoft Sentinel exports, review how each rule maps, and install the chosen proposals as draft rules.
IT command center
One inventory of what you run, who owns it and what changed — across on-premises and cloud, read-only by design.
Estate map and resource detail
Every resource in your scopes with its owner, sources, freshness, attributes, related resources and a timeline of changes, alerts and situations.
Kubernetes and OpenShift
Clusters, nodes, namespaces, workloads and KubeVirt virtual machines, and on OpenShift its operators and machine pools.
Virtualisation
Virtual machines, hosts, clusters and storage from Proxmox VE, vSphere and KubeVirt, with Proxmox Backup Server coverage for each guest. Proxmox Datacenter Manager can be a source too.
Cloud
Azure subscriptions, AWS accounts and Google Cloud projects with their resources. Cloud connectors sign in with federated workload identity rather than stored keys.
Posture
Configuration checks from the cloud providers and Kubernetes policy reports, normalised to one control set.
Drift and infrastructure as code
Which resources Terraform, Argo CD, Helm, CloudFormation, ARM deployments or Deployment Manager manage, which ones none manages, and a Terraform state sync.
Situations
Alerts grouped by resource, with owner, preceding changes on the resource and its neighbours, the event log and an optional AI diagnosis. Acknowledge or resolve in one place.
Alertmanager receivers
Webhook receivers with their own token, so Prometheus alerts become signals linked to resources on the estate map.
Ownership
Owners inferred from tags, labels, namespaces, infrastructure-as-code stacks and directory groups, with manual overrides and coverage against a target.
Relays
Enrol Relays with one-time tokens, watch their health and revoke them. Relays keep the inventory fresh with change watches and periodic relists.
Connector manifests and health
Download each signed manifest and hand the exact role definitions to the system owner; follow freshness, last success and job outcomes per connector.
Estate export
Your resources, relationships and attribute history as a signed bundle in JSON Lines and CSV, to keep or to move elsewhere.
Leadership scorecard
How complete, owned, secure and current the estate is, with the query behind each figure so it can be checked.
My IT
A start page for everyone: describe what you need in your own words, review the request before it is sent, and follow your requests and the decisions waiting for you.
Request queue
The service desk’s view of every request in its scopes: triage, assign, comment, link and fulfil, with service targets, a lost-time survey on closure and the full history.
Approvals
Every approval waiting for you — response actions, IT requests, changes or access — decided in the console, by email, in Teams or in Slack. Every decision, from any channel, goes through one check of state, expiry, separation of duties, permission and policy.
Workspaces, search and inbox
Each role sees one short menu for its work, with search across pages and records, an inbox of what waits for you and an ask bar.
Private AI
AI that helps people decide, on infrastructure you choose. It never changes anything on its own.
Security assistant
A conversation about one finding, case or log pipeline; each message starts a fresh analysis of its current evidence.
Investigate with AI
Guided analysis and advisory assessments on findings, incidents and cases, with a history of reviewed analyses.
Situation diagnosis
An optional, read-only diagnosis of an IT situation that cites its evidence and what changed before it started.
Detection copilot
Describe a behaviour in English or French; get a rule draft with invented events that must and must not match, run through the real evaluator.
Connect logs with AI
A guided wizard that proposes how a new log format maps to events; you check and correct it on a small sample.
Advisory assistant
Paste a security advisory; the AI lists its ATT&CK techniques and indicators and the page compares them with the catalogue and your data.
Knowledge library
Versioned runbooks and references the AI may quote, used only after approval, with reader groups, retention and legal holds.
AI evidence ledger, evaluation and scorecard
Every run recorded with fingerprints; evaluations on synthetic, labelled cases; a scorecard that compares AI results with the decisions people recorded.
Request routing and approval briefs
Suggests whether what someone typed is a question, a request, a problem, a change or a report, and where it should go; an optional brief helps an approver decide. Nothing is created or decided by the AI.
Help assistant
Answers questions about the console from its bilingual help only, never from your records.
Trust and evidence
Controls are enforced by the platform, not left to policy documents.
Audit log and revisions
Who changed what, when and why, with the history of every revised record. Evidence content is never shown in the log.
Evidence audits and reconciliation
Scheduled integrity audits of stored evidence and reconciliation reports between what was received and what was stored.
Retention and archive
Retention policies, record classes, legal holds and disposition plans; an archive tier in write-once object storage with signed manifests, searchable from hunts and rehydrated on demand.
Control evidence
Facts the product records — audit chain verification, retention and holds, source health, review separation, case handling times, AI ledger completeness — mapped to common control frameworks, with signed evidence packs for auditors.
Logging coverage
Compares the events you actually store with recommended event classes and lists the gaps as work items, alongside silent assets that should send events but do not.
Report centre
Executive, operations, detection, response, compliance and AI reports computed from stored records, scheduled or on demand, in English and French.
Leadership briefs
A weekly summary of activity, incidents, response times, threat families, source health, coverage and decisions requested.
These controls describe how the product is built. Certification or accreditation of a specific deployment remains with your organization.
Deployment and identity
Built for your own Kubernetes and PostgreSQL, with nothing calling home.
Identity providers
Single-tenant Microsoft Entra ID with Conditional Access claims challenges, Active Directory federated through Keycloak, or any OpenID Connect provider, with groups mapped to roles.
Permissions and workspaces
Server-owned entitlements per application, role templates and scoped grants; workspaces for Security, Operations, Cloud, Leadership, Governance and platform administration.
Notifications and webhooks
Email, Microsoft Teams, Slack or signed webhooks, in English, French or both, through channels an operator approves. Webhooks are delivered at least once with verifiable signatures.
AI clients through MCP
Connect an AI client through the Model Context Protocol; it acts as you, with your sign-in, your application and your permissions.
Platform operations
Jobs, workers, deliveries, diagnostics, API performance and metrics show the health of the whole pipeline; directory connections and protected backups of the disposal ledger, with proof that restores work.
Shared services
Tenant groups for organisations that serve several applications: a group console, a library of reviewed content rolled out as drafts, and usage with budgets and chargeback.
Runs on
Kubernetes, PostgreSQL 17, shared storage for encrypted evidence and an OpenID Connect identity provider; a model host if you use AI.
Ready to see it with your own data?
Sign in with your organization account, or contact us to plan a deployment in your environment.