ERA WorkbenchUnified investigation timeline

One incident screen: events from hosts, accounts, network, and mail logs assembled into a single chronology — without switching between SIEM, EDR, and separate consoles. The analyst sees the full attack chain and decides faster.

Purpose

Close the gap between "lots of data" and "convenient investigation." Workbench is the analyst's workspace, not another report.

Key capabilities

• Unified case timeline: endpoint, identity, network, email.
• Alerts, events, and assets linked on one SOC Portal screen.
• Same roles and access policies as incident cases.

Who it's for

SOC analysts and threat hunters in organizations with multiple telemetry sources.

Platform integration

Extension of ERA Core and SOC Portal; complements ERA Control AI investigation. No separate agent required — uses data already collected by the platform.