Triage with the evidence
Every alert comes back with a severity, the technique behind it and the asset it touches — so an analyst can agree or override in seconds.
203 alerts in · 1 incident outIndustries/Yosha ShieldPlanned · future expansion
Security at machine speed,
evidence at every step.
Yosha Shield triages alerts, rebuilds incident timelines and maps them to CERT-In and DPDP rules — so your team spends its time responding, not reading.
Grounded inCERT-InDPDP ActIT ActISO 27001NIST CSFMITRE ATT&CK
How an attack is stopped
- Alarms come inSOC tier 1
203 alerts overnight on the file server. Which ones matter?
203 alerts · 4 incidents once grouped - Attack path foundT1053.005 · T1041
A hidden task was planted on the file server, and 40 minutes later a large amount of data left it. That server holds the finance files.
- What to doA person approves
Severity high. Save the evidence, then cut the file server off the network.
Illustrative · nothing is stopped until a person approves
Why Yosha ShieldLess time reading alerts.
Less time reading alerts.
More time responding.
The timeline, rebuilt
EDR, identity and network logs are merged into one account of what happened, in order — with the gaps stated, not filled in.
EDR · identity · proxy → one timelineReports inside the clock
CERT-In and DPDP filings are drafted from the incident record while the response is still running. Nothing is filed without approval.
Noticed 02:40 · due 08:406
SOC tools
Triage, advisories, phishing, timelines, controls and reports — on one security model.
7
Frameworks mapped
CERT-In, DPDP, the IT Act, ISO 27001, NIST CSF, MITRE ATT&CK and OWASP.
6h
CERT-In clock tracked
Specified incidents must be reported within six hours of being noticed.
The platform
Six SOC tools. One security brain.
From the morning advisory to the midnight report, every tool reads from the same evidence — and every call shows what it rests on.
Triage DeskOvernight · 203 alerts
- ×2Scheduled task + outbound transferFILE-SRV · T1053.005 → T1041Escalate
- ×1Service account, new subnetSubnet added last weekConfirm
- ×1PowerShell downloadMatches sanctioned admin toolConfirm
- ×168SMB signing re-firesScheduled scan · duplicateClose
- ×31Login failuresAllow-listed scannerClose
203 alerts · 1 to escalate · severity written down with its evidence
For SOC tier-1 and tier-2. Takes the alert queue and returns each one with severity, context and the evidence behind the call, so an analyst can agree or override it in seconds.
Screens are previews of how each tool is designed to work. The tools ship in phases.
Who it's forOne security analyst.
One security analyst.
Every team that defends.
The SOC triages. GRC reports. Fraud teams chase networks. MSSPs run many clients. Underneath, it is the same evidence trail — only the job changes.
SOC tier 1 & 2Queue
Open a decision, not a spreadsheet.
The overnight queue arrives already grouped and ranked, with the evidence behind each call written into the incident record.
- Duplicates and known noise are grouped and closed with a note.
- What is left is ranked by the asset and the technique, not the vendor score.
- The analyst agrees or overrides — and the reason is kept.
203Alerts→1To escalate
YYosha Shield · Triage queueRanked by asset and technique4open of 203
×1Scheduled task on FILE-SRVEscalateFinance share · critical
×1Outbound transferEscalateSame host, 40 min later
×1Service account, new subnetConfirmSubnet added last week
×1PowerShell downloadConfirmSanctioned admin tool
One incident · severity highT1053.005 persistenceT1041 exfiltrationFILE-SRV · critical
An analyst agrees or overridesApprove escalation
Report clockPreview
Noticed 02:40Due 08:40
Incident category
Affected systems
Timeline so far
Indicators observed
CISO approved · filed
CISOs & GRCDesktop
File inside the six hours.
The CERT-In report is drafted from the incident record while the response is still running — and filed only when the CISO approves.
Mule clusterPreview
DevicePayee1 cluster · officer decides
Fraud & risk unitsDesktop
See the network, not the account.
Shared devices and shared payees link accounts that look normal on their own. The freeze decision stays with the bank's officer.
Tenant boardPreview
Client A · bank2 escalated475 alerts triaged · own index, own logs
Client B · insurerClear278 alerts triaged · own index, own logs
Client C · hospital1 escalated382 alerts triaged · own index, own logs
Same severity rubric · separate tenants
MSSPsDesktop
Many clients. One standard.
Every client gets the same triage rubric, with its own index, its own logs and nothing shared across tenants.
End to endFrom first signal
From first signal
to final filing.
Prevent, detect, triage, contain, report and review. Yosha follows each stage with the frameworks that govern it.
Prevention · Always on
Before anything fires
Advisories land every week — a new CVE, an exploited edge device, a campaign against Indian banks. Prevention is the work of turning that stream into a patch list and an exposure list before anyone is attacked.
What the SOC needs
- Advisories read and matched to the asset inventory
- Exposed versions and missing patches listed
- Exploited-in-the-wild prioritised over severity scores
- Exceptions recorded with an owner and a date
Frameworks in view
- CERT-In advisories and vulnerability notes
- CVE / NVD records with CISA KEV status
- ISO 27001 Annex A — technical controls
KnowledgeGrounded in the advisories.
Grounded in the advisories.
Fluent in Indian lures.
Calls come from CERT-In, the frameworks and your own telemetry — and the newest advisory replaces the one it supersedes as it is published.
Frameworks
- CERT-In directions & advisories
- DPDP Act, 2023 and DPDP Rules, 2025
- IT Act, 2000 and rules
- ISO 27001
- NIST CSF
- MITRE ATT&CK
- OWASP Top 10
Telemetry
- EDR / XDR
- SIEM alerts
- Firewall & proxy logs
- Authentication logs
- Cloud audit trails
- Email gateway
- DLP alerts
Incidents
- Phishing & business email compromise
- Ransomware
- Credential stuffing
- Mule account fraud
- UPI & payment fraud
- Insider threat
- Supply-chain compromise
- Personal data breach
Languages
- English
- Hindi
- Bengali
- Tamil
- Telugu
- Marathi
SecurityYour logs
Your logs
stay in your network.
Yosha Shield is installed on your own infrastructure. Telemetry, searches and incident records never go to an outside cloud.
Your network
Yosha Shield model
Telemetry & logs
Search index
Incident records
Blocked
Shared cloud & other tenants
Runs inside your network
Installed on your own infrastructure. Nothing is shared with other customers.
Logs never leave
Authentication logs, packet captures and mailboxes stay where they are.
Private index
The advisory and control index is built and kept on your servers.
Every call recorded
Each severity call, its evidence and who approved it go into the incident record.
Evidence, or it says so
When the evidence is thin, the call is marked unverified instead of guessed.
A person approves
Isolating a host, blocking a domain or filing a report always needs a named responder.
Every alert, answered with evidence.
Triage, timelines and regulator reports — every call traceable to the log line and the rule behind it.