Turn evidence into defensible conclusions.

Meet Phantom: an investigation-first desktop application being developed to help security analysts import evidence, reconstruct activity, test explanations, draft searches, and document findings in one workflow.

See the actual app ↗What Phantom is designed to do

These are real screenshots captured from a working Phantom 1.9 RC7.7 development build on September 23, 2026. All displayed incidents and records are synthetic test data. Interfaces and capabilities may change before release; this is not an available download or a production-service guarantee.

Next-generation interface direction

Concept B: Evidence Ledger.

Evidence first. Every observation linked to its origin, every conclusion tied to supporting or contradictory signals. This is a design exploration of the next-generation Phantom interface.

UI CONCEPT · NOT RELEASED

Original Concept B Evidence Ledger design from the Phantom UI Showcase

01 / Evidence trail

Search and filter source events without losing timestamps, provenance or case context.

02 / Relationship clarity

Distinguish observations from supporting, contradicting and corroborating evidence.

03 / Contextual inspector

Keep the selected event and its supporting metadata available beside the evidence ledger.

See the current development build ↗

Design concept only. The images below are separate, actual development-build screenshots using synthetic test cases; Concept B does not represent shipped functionality.

Inside the current development build

Actual Phantom UI. Not mockups.

Captured from the running desktop application during a synthetic SOC investigation. Select any screenshot to see the full image.

Actual Phantom RC7.7 application screenshot: Mission Control, captured from a synthetic case — **Mission Control ↗**Case context, working assessment, evidence references, and investigation next steps.

Actual Phantom RC7.7 application screenshot: Evidence Court, captured from a synthetic case — **Evidence Court ↗**Review supporting and contradictory signals while keeping uncertainty visible.

Actual Phantom RC7.7 application screenshot: Event timeline, captured from a synthetic case — **Event timeline ↗**Explore and filter the chronological record of an investigation.

Actual Phantom RC7.7 application screenshot: Detection review, captured from a synthetic case — **Detection review ↗**Inspect detection findings, relevant events, and investigation leads.

Actual Phantom RC7.7 application screenshot: Query Workbench, captured from a synthetic case — **Query Workbench ↗**Generate reviewable searches for supported security and log platforms.

Actual Phantom RC7.7 application screenshot: Phantom Analyst, captured from a synthetic case — **Phantom Analyst ↗**Ask case-focused questions and examine cited, evidence-linked analysis.

Actual Phantom RC7.7 application screenshot: Investigation reporting, captured from a synthetic case — **Investigation reporting ↗**Build structured reports from an investigated case.

Development-build disclosure. These images show the real RC7.7 interface, not proposed redesigns or live customer environments. Screenshots may differ from the final application.

What Phantom will help analysts do

One workspace. A clearer path from alert to answer.

The goal is to shorten the distance between raw security data and a well-supported analyst decision—not to automatically declare every alert malicious.

01 / EVIDENCE

Import and organize evidence

Bring supported security-event exports into a local case workspace, preserve source context, and inspect normalized records.

02 / INVESTIGATE

Reconstruct the story

Use a timeline, detection results, and entity context to connect events and distinguish confirmed facts from investigative hypotheses.

03 / REASON

Evidence-linked analyst guidance

Ask case-scoped questions, inspect citations, note contradictory evidence, and document what is still unknown. Local AI capabilities remain under development.

04 / QUERY

Generate investigation queries

Prepare platform-specific searches for tools such as Defender, Sentinel, Sumo Logic, Check Point and CrowdStrike LogScale. Review them before executing in your own environment.

05 / DOCUMENT

Create defensible reports

Produce case summaries, investigation packs, evidence references, and next-action recommendations for analyst review.

06 / OPERATE

Designed to work offline

Prioritize local evidence review without requiring production credentials or sending log files to a public AI service by default. Future integrations will be assessed and disclosed separately.

Development priorities

Building deliberately, validating continuously.

Phantom is still being developed and tested. We are focusing on correctness, analyst control, reproducibility, and a stable Windows desktop experience before a public release.

Before launch, our priorities include:

Improving application reliability and user-interface consistency
Validating investigation quality across diverse real-world log types
Refining the local AI experience and evidence citations
Testing packaging, deployment, updates, and security safeguards
Clearly documenting integrations and supported environments

Follow the development

Interested in Phantom or our Managed SOC services?

Reach out to discuss your security-operations needs, learn about the Phantom development roadmap, or ask about future availability.

Contact Phantom ↗Back to services