Learning mode

Turn your SOC’s workflows into discoverable maps.

In Learning Mode, Legion passively captures how your analysts investigate and respond, switch between tools, and make decisions, and maps them to create full team visibility.

Banner with a griffin icon and text reading 'Capture analyst behavior in a click, learns from real analyst behavior and captures how investigations unfold across tools and alerts.'

LEGION application interface showing Sessions tab with options to start recording and view previous investigation sessions.

Banner with a stylized bird symbol and text reading: 'Recorded audit trail. Get a built-in resource for training, documentation and compliance review.'

Dashboard showing phishing investigation summary with status 'Success', analyst info, duration, and detailed investigation steps including case extraction, user detail search, incident entity extraction, IP reputation checks, and query results.

Banner with a gryphon icon and text: Build an expansive team-wide memory. Classify by use case, map processes, and see your team’s patterns.

Dashboard showing phishing use case with metrics for MTTR 2:05 min, MTTA 0:37 min, MTTI 1:28 min, time saved 28:45 min, and decision accuracy 93.4%, alongside a process graph of incident review steps involving Jira, Sentinel, Defender, Abuse PDB, VirusTotal, URLScan, and triage.

Trained from scratch on your tribal knowledge.

Ready to let Legion breathe fire?

EXPLORE guided mode

“Legion blew me away. It’s one of the first times I’ve seen AI actually capture, summarize, and build on real analyst work instead of just making things up.”

Sr. Threat Hunter @ F500 Healthcare

book a demo