Home
Home
Observe. Reason. Act. Verify.
Pashupatastra assembles scattered signals into a single incident with a causal chain, maps each step to a known technique, and proposes a response that is scored before anyone runs it. Every claim it makes carries a link to the evidence it came from.
Start here
The worked incident is a written scenario, labelled as one wherever it appears — it exists to show the whole chain end to end. The attacks on the Observatory are real: ransomware groups naming victims, botnet controllers answering right now, breaches as they are disclosed.
Most tools stop after the second. Pick a stage to see what happens there and which model does the work.
Alerts, metrics, logs and flows from every tool become one kind of event, each keeping a link to where it came from.
Describe what an attacker did and the models name the technique, or the defences that stop it.
Tap one. The answer comes live from Sati's own models, with its sources.
Android
The app, with pull to refresh and its own icon. A free test build: download it on the phone, open it, and allow the install when Android asks.
iPhone and iPad
Actions needing a human
21 of 25
anything that changes something waits for a person
Benchmark accuracy
—
no committed evidence — docs/benchmark.json has not been generated
Each figure is recomputed from the store or the action registry on request, and names where to go and count it again. A figure whose source is not committed is reported absent rather than as a number nobody can check.
Before — four separate alerts
Ninety minutes apart, in different tools. Each one is individually ignorable, and each one was ignored.
After — one incident
A workstation is beaconing to a command-and-control host and has begun moving laterally: new SMB peers, then a scheduled task on one of them.
The cost of an intrusion is not the alert. It is the gap between the first signal and the moment someone connects it to the fourth. In the three scenarios on this site that gap is 11, 30 and 90 minutes — and every minute of it is an attacker working uninterrupted while four true alerts sit in four different tools, each one too small to act on alone.
Every executable action is registered with a risk score and routed through the policy engine. There is no path around it — not in the product, and not in the demo fixtures.
Scored, not judged
Risk is computed from blast radius, confidence and reversibility — then a tier decides who may authorise it.
Rollback declared first
An action states how to undo it and what it expects to be true afterwards, before it is allowed to run.
Two shut gates
This deployment is in dry run and its environment is not on the live list. Both must open before anything executes.
The tiers, the gates and the registry are on how it works, generated from the running system rather than written down.
The assistant is bound by the same rule: ask it to isolate a host and it names the action, sends it for approval, and executes nothing. Try that →
The worked incidents are scripted and labelled as such. Everything on the Observatory is real and polled hourly: ransomware groups naming victims, botnet command-and-control servers answering now, breaches as they are disclosed, and CISA’s catalogue of vulnerabilities being exploited in the wild. Nothing on this site executes anything.