Concord by IaxaI
Concord makes your security tools agree on what they're seeing. And it knows when they shouldn't.
One engine. Six capabilities. Three surfaces you can buy independently. Built for the MSP/MSSP channel and the regulated mid-market clients they serve.
The Architecture
Engine on the bottom. Surfaces on top.
Concord splits cleanly into two layers. The engine is the indivisible data plane. The six capabilities only work together. The surfaces are products: separately demoable, separately sellable, all reading from the same engine state.
Surfaces: what you buy
Semantic Alert Dedup
Detection Portability Layer
Compliance Evidence Auto-Packets
Core engine: the indivisible data plane
Semantic Translation Engine
Entity Resolution Engine
Drift Detection + Auto-Repair
Auditability Ledger
Universal Adapter
Knowledge Graph + Retrieval
Every engine output threads through the Auditability Ledger.
The split is the point. Auto-Packets ships to MSPs while Entity Resolution and Drift keep maturing. New surfaces drop in without re-architecting the data plane. New engine capabilities improve every surface at once. No monolith.
The Core Engine
Six capabilities. One data plane.
They share state. They thread the ledger. They only make sense together.
Semantic Translation Engine
Patent (in prosecution)
Vendor logs in, OCSF events out, with calibrated confidence and a reverse transpiler so detections written once run on Splunk, Sentinel, LogScale, or Sigma.
Learn moreEntity Resolution Engine
Patent (in prosecution)
The same user, IP, host, or hash across vendors, resolved with a Bhattacharyya score, a temperature-scaled probability, and a conformal prediction set you can actually trust.
Learn moreDrift Detection + Auto-Repair
Patent (in prosecution)
Watches input, output, and schema-shape on every live stream. When a vendor silently changes a field, the pipeline notices and repairs itself instead of going quietly blind.
Learn moreAuditability Ledger
Append-only, hash-chained record of every decision the engine makes. Every translation, every match, every repair, every override. Replayable, signable, regulator-ready.
Learn moreUniversal Adapter
Syslog, webhooks, file uploads, connector pulls. Known vendors hit a cached mapping in sub-millisecond. Unknown vendors get parked, flagged, and derived offline. Never on the live event.
Learn moreKnowledge Graph + Retrieval
Resolved entities, normalized events, and extracted relationships in one dense-sparse graph. CPU-hybrid HippoRAG retrieval. No LLM in the query path.
Learn moreThe Surfaces
Three wedges. Buy them on their own. Or stack them.
Each surface targets a real buyer with a real budget line. All three sit on the same engine, so adopting one makes the next one cheaper.
Semantic Alert Dedup
For SOC managers drowning in duplicate alerts across five tools. Collapses the same event into one narrative, not five tickets.
Learn moreDetection Portability Layer
For detection engineers tired of rewriting the same rule in four query languages. Author once against OCSF, ship to every platform in the stack.
Learn moreCompliance Evidence Auto-Packets
V1 wedge
For MSPs whose regulated clients face FFIEC, SOC 2, HIPAA, or PCI audits. Evidence assembles itself from the ledger as a byproduct of running the engine.
Learn moreWhy The Split Matters
Clean separation is a feature, not an aesthetic.
Ship surfaces independently.
Compliance Auto-Packets goes to MSP partners now. Entity Resolution and Drift keep hardening underneath. No surface waits on full engine completion.
Every output is evidence.
The Auditability Ledger threads through every engine capability. Translation decisions, ER merges, drift repairs, and dedup collapses all leave a hash-chained receipt. Compliance is a byproduct, not a project.
Engine improvements compound.
A better calibration on Entity Resolution makes Dedup tighter, DPL detections more portable, and Auto-Packets more defensible. All at once. One change. Three surfaces lift.
The Guarantee
No ML in the hot path.
Every event you send into Concord hits deterministic code on the way through. Cached mappings. Closed-form math. Pre-calibrated thresholds. The LLM lives in onboarding and in the drift-triggered repair loop. Never on the live event.
That's the difference between a demo that works on Tuesday and an audit that holds up in October. Regulated MSPs need both. So do their banks.
30+ vendor mappings, 6 production-ready connectors. 768-dimensional embeddings with Platt-calibrated confidence (internal benchmarks; security-domain validation in progress). Every translation, match, and repair signed and ledgered.
Stop reconciling. Start trusting one timeline.
30-minute walkthrough. Your tools. Your tenants. Your audit cycle. We will show you exactly where Concord earns its keep.