Findings surface in your SIEM or case-management system — or in the Compiled findings console. Each finding carries a score, the specific policy it matched, the channel, a timestamp, and a verdict. Analysts review, confirm, or dismiss. No black-box scores. No mystery.
Stylized representation. Findings layout and fields are configurable. Raw communication content never appears in findings — only scored metadata and policy attribution.
Compiled is designed as a high-recall triage layer. Findings are calibrated to your traffic before go-live, and thresholds are tunable. The analyst workflow is intentionally minimal: each finding is reviewed, confirmed as a real event, or dismissed with a reason. Confirmed findings route automatically to the case management or SOAR tool your team already uses.
A scored finding arrives in the findings queue — or directly in your SIEM or case-management system via the configured routing rule. It carries: a finding ID, timestamp, channel, the specific policy matched, a score, and a verdict (flag or block). No raw communication content.
The analyst reviews the finding metadata and, where permitted by policy, the communication excerpt. The score and policy attribution tell the analyst exactly what the engine saw and why. There is no black-box explanation to reconstruct.
Confirm as a genuine event — the finding escalates to case management, a SOAR playbook, or the compliance workflow. Dismiss with a reason code — that signal is recorded and can inform threshold calibration in subsequent review cycles. Every decision is logged.
Confirmed findings route to the destination your team configured — Splunk, Microsoft Sentinel, ServiceNow, or any SIEM or SOAR via the structured findings output. The full evidentiary record — timestamp, score, policy, verdict, analyst action — is in your environment, ready for an examination.
Compiled outputs structured findings to the tools your SOC and compliance team already use. There is no new home for your data, no new interface to monitor, and no new training burden. Your existing tooling and playbooks handle the escalation.
Raw communication content is never included in findings output. Only scored metadata and policy attribution cross the SOC boundary.
Compiled is a managed application — not a professional-services engagement. Your team does not tune models, write rules, or run refinement cycles. That operational burden belongs to Compiled.
Antibody updates are the only artifact that crosses the boundary into your environment inbound. Each update is cryptographically signed, carries a version identifier and a human-readable changelog, and is verified by your deployment before it is applied.
Compiled operates as a high-recall triage layer, not a zero-false-positive oracle. The honest operational reality: detection is calibrated to your traffic before go-live, thresholds are tunable, and the score on every finding tells you exactly how confident the engine was. Alert fatigue is addressed through calibration, not overclaiming.
Book a 30-minute session to see the analyst view, the triage workflow, and how findings would route into your existing SIEM or case-management tool. We can tailor the walkthrough to your stack.
sales@compiled.co