sudoexec

Two products, one idea

sudoexec does not sell one more detection brick. Its two products address what happens between the tools and upstream of them: the Meta Orchestrator links the bricks of a SOC to each other, Sudo Trace supplies them with intelligence whose origin and date can be checked. Both answer the same observation — the value of a security stack depends less on the quality of each product than on what joins them together.

The Meta Orchestrator — what makes a SOC « next-generation »

• Inter-enrichment

  An alert raised in one tool is completed with what every other tool knows — identity, intelligence, network, email. The analyst receives a qualified incident, not a line to chase across five consoles.

• Inter-remediation

  The response is no longer confined to the tool that detected: endpoint isolation, session revocation, gateway blocking and message quarantine all follow from a single decision.

• Above the stack, not inside it

  It detects nothing itself and replaces no product. That is what keeps the stack replaceable brick by brick, instead of locking the client into a single supplier.

Sudo Trace — intelligence that can be checked

• Evidence as a constraint, not an intention

  A relationship without evidence is rejected by the database itself. It is not a good-conduct rule that gets bypassed under deadline pressure.

• Epistemic status

  Every statement says on what grounds it is known: observed by a source, derived by a rule, proposed by a model, or settled by a human. A machine output can never rise above the rank of hypothesis.

• Dating

  « Who owned this address on 12 July » is a question the platform answers. It is the one you ask during an investigation, and almost no tool answers it.

• Search without exfiltration

  The platform looks for its infrastructure in your logs without ever taking their content away. Your data stays with you.

What we do with it

The Meta Orchestrator carries the inter-enrichment and inter-remediation of our NextGen-SOC: it is what turns alerts from the different bricks into qualified incidents and coordinated actions. Sudo Trace feeds it, and its indicators are applied retrospectively to our clients' logs — a marker published today is matched against months of past data. Lists ready for firewalls and SOAR are pushed straight into the devices.

Our assessment, without varnish

An orchestration layer inherits the limits of what it orchestrates: it does not make up for a missing source, and a badly tuned tool upstream simply produces better-distributed noise. The real gain is decided at the scoping stage — which actions are pre-authorised, which sources are genuinely connected — more than in the technology itself.