Log in Request a demo
Agentic Analyst

Odin, Your Agentic Analyst. It Investigates, Then Writes The Report.

Odin works like an analyst on your team. It reaches your workspace, plans the investigation, shows each step and writes the report. It stops before anything changes.

Request a demo Watch A Sample Case
Odin · InvestigationSAMPLE DATA · ACME.COM

You ask“Was acme.com mentioned on the dark web this week, and does it matter?”

Odin Reading
Dark Web Cybercrime Database Attack Surface Management Threat Actors Phishing And Takedowns Vendors Incidents Reports
1 / 8 · Reading Dark Web search_darkweb(query: "acme.com", days: 7) 9 mentions 2 / 8 · Reading Cybercrime Database The Brandefense archive 3 / 8 · Reading Attack Surface Management match_assets(mentions) 2 match your assets 4 / 8 · Reading Threat Actors get_actor(handle) Past verified sales 5 / 8 · Reading Phishing And Takedowns Lookalikes and case status 6 / 8 · Reading Vendors Supplier exposure 7 / 8 · Drafting Incidents Every module, every status 8 / 8 · Writing Reports Brief · Access Sale For acme.com Report ready Done · Waiting for you Odin does the reading, searching and writing. Anything that changes something waits for a person.
Reach

Reads Everything You Can See.

One question can touch every part of the platform. Odin works within the access of the person asking.

Same access as the person asking
  1. 01 IncidentsEvery module, every status
  2. 02 Attack Surface ManagementAssets, services, exposures
  3. 03 Dark WebForums, markets, channels
  4. 04 Threat ActorsProfiles, tools and targets
  5. 05 Phishing And TakedownsLookalikes and case status
  6. 06 VendorsSupplier exposure
  7. 07 Cybercrime DatabaseThe Brandefense archive
  8. 08 ReportsResearch and past briefs
Working Rhythm

How Odin Works A Shift.

You hand over the case. Odin works it the way a colleague would, and comes back to you before anything changes.

  1. 01 Reads Opens the incidents, assets and sources the signed-in user can see.
  2. 02 Thinks Plans the checks first, and shows you the plan.
  3. 03 Asks Puts one precise question to each source. Every step names its tool.
  4. 04 Writes Drafts the report and lists what it is built from.
  5. 05 Waits Stops at your approval.

Odin does the reading, searching and writing. Anything that changes something waits for a person.

What it does, asks and never does
One Investigation

Watch Odin Work A Case.

A dark web mention, start to finish. Every step is shown and every source is listed.

  1. "Was acme.com mentioned on the dark web this week, and does it matter?" “Was acme.com mentioned on the dark web this week, and does it matter?” You, in plain words
  2. plan(dark web, cybercrime database, seller, assets, incidents) Plan shown 1 Dark web mentions2 Cybercrime database3 Seller profile4 Your attack surface5 Open incidents Odin’s plan, shown before it acts
  3. search_darkweb(query: "acme.com", days: 7) 9 mentions 9 mentions in 7 days2 posts matter: 1 offers VPN access to vpn.acme.com Dark web forums (post redacted)
  4. Brandefense cybercrime database · archive lookup Post confirmed Post confirmed in the archiveSeller handle recorded Brandefense cybercrime database
  5. get_actor(handle) Past verified sales Seller handle (redacted)Past verified sales Brandefense threat actor profiles
  6. match_assets(mentions) 2 match your assets vpn.acme.com · login portal exposed to the internet2 of 9 mentions match your assets Attack surface inventory
  7. incident_related("vpn.acme.com") No incident open yet No open incident for vpn.acme.comA draft incident can be opened Incidents, every module
  8. generate_incident_report(id) Report ready · sources listed Brief · Access Sale For acme.comSeverity Critical · next step: reset VPN credentials Every finding links back to its record
  9. Proposed: reset VPN credentials, open the incident Waiting for you Reset VPN credentialsOpen the incident Nothing changes until a person approves
Odin · Sample case Step 1 of 9
Question00:00

You ask in plain words

No query language. Ask the way you would brief a colleague.

Tool call"Was acme.com mentioned on the dark web this week, and does it matter?"
Sample output “Was acme.com mentioned on the dark web this week, and does it matter?”
SourceYou, in plain words
Plan00:02

Odin plans the checks

Odin plans before it acts, and shows you the plan.

Tool callplan(dark web, cybercrime database, seller, assets, incidents)
Sample output 1 Dark web mentions2 Cybercrime database3 Seller profile4 Your attack surface5 Open incidents
SourceOdin’s plan, shown before it acts Plan shown
Search00:05

Dark web mentions

Each step names the tool and the source behind it.

Tool callsearch_darkweb(query: "acme.com", days: 7)
Sample output 9 mentions in 7 days2 posts matter: 1 offers VPN access to vpn.acme.com
SourceDark web forums (post redacted) 9 mentions
Search00:09

Cybercrime database

The cybercrime database adds what a scanner cannot see.

Tool callBrandefense cybercrime database · archive lookup
Sample output Post confirmed in the archiveSeller handle recorded
SourceBrandefense cybercrime database Post confirmed
Correlate00:14

Seller profile

The seller is checked against threat actor profiles, not judged by a name.

Tool callget_actor(handle)
Sample output Seller handle (redacted)Past verified sales
SourceBrandefense threat actor profiles Past verified sales
Correlate00:19

Your attack surface

One finding becomes a case: the post points at a real, exposed login portal.

Tool callmatch_assets(mentions)
Sample output vpn.acme.com · login portal exposed to the internet2 of 9 mentions match your assets
SourceAttack surface inventory 2 match your assets
Search00:23

Open incidents

Odin checks whether someone is already on it before it proposes anything.

Tool callincident_related("vpn.acme.com")
Sample output No open incident for vpn.acme.comA draft incident can be opened
SourceIncidents, every module No incident open yet
Draft00:26

Report written

The report lists its sources, so you can open each one.

Tool callgenerate_incident_report(id)
Sample output Brief · Access Sale For acme.comSeverity Critical · next step: reset VPN credentials
SourceEvery finding links back to its record Report ready · sources listed
Approve00:27

Actions proposed

Odin stops here. A person approves before anything changes.

Tool callProposed: reset VPN credentials, open the incident
Sample output Reset VPN credentialsOpen the incident
SourceNothing changes until a person approves Waiting for you
Sample run on acme.com. Times are illustrative.
Reports

It Writes The Report.

Different formats from the same investigation, each with its sources listed.

One investigation, three formats
  • Written from the same investigation
  • Sources listed for each finding
  • Prepared by Odin, marked as a sample
Odin · ReportSAMPLE · ACME.COM
BrandefenseExecutive BriefPrepared by Odin Access For Sale: vpn.acme.com
Summary

A dark web post offers VPN access to vpn.acme.com. The seller has past verified sales. The login portal is exposed to the internet and no incident was open yet.

SeverityCritical
Assetvpn.acme.com
RiskAccount takeover
StatusActions awaiting approval
Recommended Actions
  • Reset VPN credentials
  • Open an incident
  • Watch the forum for new posts
Built fromDark web post (redacted)Brandefense cybercrime databaseAttack surface inventory
Sample output on acme.com.
BrandefenseTechnical ReportSample vpn.acme.com · Technical Report
Indicators
vpn.acme[.]com
seller handle: (redacted)
forum: (redacted)
post date: sample
Timeline
Day 0Post appears on a forum
Day 1Matched to vpn.acme.com
Day 2Seller profile reviewed
Day 3Report drafted, actions proposed
Detection
  • Company name found in a dark web post
  • Asset matches an exposed login portal
  • Seller has past verified sales
Built fromDark web post (redacted)Brandefense cybercrime databaseThreat actor profile
Sample output on acme.com.
BrandefenseBoard SummaryQuarterly External Risk · Quarterly
Top Risks
  • Access to our systems offered for sale on the dark web
  • Suppliers with new exposure
  • An exposed admin panel found and closed
Asks For The Board
  • Approve a customer phishing awareness note
  • Require fix plans from suppliers with serious exposure
Sample output on acme.com.

Many Tools. Or One Question.

The same checks an analyst runs by hand, done in one investigation and written up.

TaskBy handWith Odin
Investigate a dark web mention Several toolsForum search, archive check, actor notes, asset match, then the write-up. One question. Each step shown, the report drafted.
Brief the CISO on the week Several toolsExport incidents, filter, chart, summarize. A brief drafted from the week’s incidents.
Check a new supplier Several toolsBreach search, exposure scan, notes. A supplier brief with the exposure and the reasons.
Profile a ransomware group Several sourcesLeak site, actor notes, CVE list, sector news. A profile tied to your sector and assets.
Answer “are we affected?” for a new CVE Several toolsAsset list, version check, exploit chatter. Affected hosts and chatter, with sources.
Playbooks

Start From A Playbook.

Saved investigations for the cases teams run most. Start one by name, on a schedule or from an alert.

01Trigger Lookalike Domain Case When a lookalike is flagged RegistrationPageInfrastructureMentions ReturnsTechnical report and takedown proposal
02Trigger New Exposure Check When a new internet-facing asset appears AssetServiceKnown flaws ReturnsPrioritised fix list
03Trigger Weekly CISO Brief On a weekly schedule IncidentsTrendsActions ReturnsExecutive brief
04Trigger Leaked Credential Triage When staff logins appear SourceAccountsSessions ReturnsReset list and incident
05Trigger Ransomware Group Profile On request Leak siteTechniquesSector ReturnsActor profile
06Trigger Are We Affected? When a CVE is exploited AssetsVersionsChatter ReturnsAffected host list
Other Ways In Odin runs inside the platform. Brandefense is also in Claude and ChatGPT.
Ask AI MCP Server Brandefense In Claude Brandefense In ChatGPT Brandefense AI Overview
FAQ

Questions About Odin.

  • Why is Odin called an agentic analyst?

    Because it does an analyst’s steps on its own: it plans, searches, correlates and writes. It stops before anything changes.

  • What can Odin access?

    Everything the signed-in user can see in Brandefense, such as incidents, assets, threat intelligence, supplier exposure and the cybercrime database.

  • How is Odin different from Ask AI?

    Ask AI answers a quick question on the screen you are on. Odin runs a full investigation across many sources and writes a report.

  • Can I check where an answer came from?

    Yes. Steps and sources are listed under the answer, and each one opens in the platform.

Watch Odin Work On Your Domain.

A partner runs a live investigation with Odin on your own workspace.

Talk To An Analyst