Platform / Investigation

Start with what happened, then inspect why.

Nexora is designed to open an investigation on a behavior with its context, effects, relationships and evidence already connected. [design intent]

Read the documentation Platform overview
A behavior record A single behavior record card. A persistence behavior with its identifier, actor, host, user and first observation time in monospace fields, its effect, its supporting evidence count, and a dashed hatched region declaring a period where no endpoint telemetry was available. Persistence Scheduled task created behavior_id bhv_8f2c41a9 type Persistence actor powershell.exe host FINANCE-WS-042 user j.smith first_observed 10:42:18Z effect Execution configured for user logon evidence 6 events / 2 sensors / 1 rule not observed no endpoint telemetry 10:42:31 - 10:44:02
A behavior record keeps the activity, its supporting evidence and its known telemetry gap in one inspectable object.
01 / Investigation

Open the behavior

The first object is the activity under investigation—not a dashboard counter or an alert that still needs to be reconstructed.

[design intent]
02 / Investigation

Move through relationships

Parent-child composition, shared resources and sequences stay part of the model rather than becoming pivots an analyst must rediscover.

[design intent]
03 / Investigation

Check the evidence edge

Direct observations, inferences and unobserved regions remain distinct so the investigation does not silently cross beyond available evidence.

[design intent]

Next step

Continue from concept to reference.

The documentation describes the shared vocabulary, architectural boundaries and evidence-state semantics used throughout the platform.

Read the documentation