Custofaber Guard

Custofaber Guard / Vigil

Always on watch

It reads the alerts, explains the incident and leaves the decision to you.

Vigil is a tireless security analyst that joins your team. It reads the thousands of lines your existing tools produce, merges the ones that belong to the same incident and writes up what happened in plain language. It runs on your organisation's server.

Request a demo How it works
Data stays in-house A person has the final say Every action is on record
Vigil Waiting 0 alerts
Incoming alerts · last night
Reading alerts from your tools…
Tamper-proof record
  1. No entries yet.
Representative screen. Sample data.

Every finding has three parts.

Every incident Vigil writes up follows the same structure. Even a manager who is not a security specialist can see at a glance what happened and what to do.

01

What happened

The course of events, in time order and without tool jargon. Which account, which system, when.

At 02:14 someone signed in over VPN as muhasebe03. Six minutes later the same account read 1,200 files on the file server.
02

Why it matters

What sets this incident apart from an ordinary alert: a comparison with the organisation's own history, and the assets affected.

This account has never signed in outside working hours. The shares it read are finance and archive.
03

What you should do

A concrete, one-step proposal. If you approve, it is applied; if you reject, the incident stays under watch. Either way it is recorded.

End the account's open sessions and reset its password.

Reads like an analyst. Explains like a colleague.

Five steps. The first four are Vigil's; the fifth is always yours.

  1. Reads

    Continuously watches Windows event logs from the Lapis agent, syslog records and the alerts from your tools.

  2. Merges

    Uses correlation rules to gather alerts about the same account, the same server and the same time window into one incident.

  3. Explains

    Writes in plain language what happened, why it matters and what it affects.

  4. Proposes

    Offers a concrete next step, such as locking an account or cutting a connection.

  5. You decide

    It applies the step only if you approve. Proposal, decision and outcome go into a hash-chained, tamper-proof record.

It does not act on its own.

No account is closed and no connection is cut; everything stays a proposal until an authorised person approves it.

It does not replace your tools.

Your firewall, endpoint protection and logging systems stay where they are. Vigil reads what they produce and makes sense of it.

It sends no data outside.

Every component, including the AI model, is on your organisation's server. It also works on networks with no internet access.

It reads what you already use.

You do not need to buy a new tool for Vigil to be useful. During installation we connect your existing sources together.

Endpoint

Lapis agent

Windows event logs, security posture (disk encryption, firewall, antivirus, local administrators), hardware and software inventory.

Network

Syslog receiver

Receives firewall, VPN, switch and server logs over standard syslog.

Identity

Active Directory

Sign-in events, group memberships and account changes. With Guard Access, privilege context is added as well.

Vigil FAQ.

Is Vigil a SIEM?

It does the collection and correlation work a SIEM does; the difference is that it presents the result as a plain-language incident summary and a proposal ready for approval. It is designed for teams without a separate security operations centre.

Where does the AI model run?

On your organisation's server. Logs, user information and analysis results are not sent to any outside service.

How is an approved action applied?

Vigil applies the action (such as ending sessions or resetting a password) on the connected system over an authorised connection. The proposal, the person who approved it and the outcome go into a tamper-proof record.

What about false positives?

Rejected proposals are recorded too, and we tune the correlation thresholds to your organisation together. Vigil never changes a threshold on its own.

Which alert sources can we start with?

The Lapis agent and syslog. An Active Directory connection adds identity context. If you have other sources, we will look at them together in the demo.

See Vigil with your own logs.

Answer a few questions and we will plan a short demo at a time that suits you.

oguz.kaya@custofaber.com
This form sends nothing to a server. Your answers are turned into an email draft that opens in your own email app; you see it before sending.
Enter the organisation name.
Type of organisation
Products you are interested in
Choose at least one product.

If your email app does not open, copy the text and send it to oguz.kaya@custofaber.com.