TRA-CE.ai
Features Proof Pricing Docs Blog

Prove what actually happened.

Security operations run on correlation. Correlation is not proof. TRA-CE builds evidence chains where every link is graded, every source is traced, and every conclusion is auditable.

Evidence-graded causal chains · Court-ready output

Correlation looks like causation
until someone checks

Three scenarios. Three failures. All because the tools showed what happened without proving why.

The chain was missing

Your SOC escalated a detection. Twelve hours later, incident response still could not explain how the attacker moved from initial access to data staging. The SIEM showed what. Nobody proved why.

The link was assumed

Three alerts fired within ninety seconds. The analyst assumed they were related. They were not. Two were noise. One was real. The correlation led to the wrong conclusion.

Three sources disagreed

The Splunk query showed a clean timeline. The EDR logs told a different story. The identity provider showed a third. Nobody reconciled the contradictions until after the board presentation.

11,000+
Average daily alerts in an enterprise SOC. Fewer than 5% are real threats.
277 days
Average time to identify and contain a breach. Most of that is spent reconstructing what happened.
4 heuristics
Explicit evidence, artifact correlation, MITRE technique progression, and temporal analysis. Each edge is graded independently.

Every link carries a
confidence grade

TRA-CE builds directed causal graphs and grades every edge independently. Confidence is measured, not assumed.

LIVE CHAIN OUTPUT 6 NODES
phishing_email (Proofpoint) PROVABLE
macro_execution (Sysmon 1) PROVABLE
powershell_download (Sysmon 3) PROVABLE
persistence_run_key (Sysmon 13) MIXED
lateral_smb (Sentinel) INFERRED
data_staging (CrowdStrike) MIXED
PROVABLE
MIXED
INFERRED

A chain with an INFERRED link at the root cannot produce a PROVABLE conclusion. Data quality is honest, not assumed. The grade propagates forward.

What TRA-CE captures
and proves

Six capabilities. Every link in the chain graded, traceable, and court-ready.

CORE ENGINE
01

Verified Event Links

Every causal edge traces to a real system event. Process ID, timestamp, source log. Not inferred proximity. Not temporal guesswork. Direct evidence.

LINEAGE
02

Cross-Source Lineage

Events from different tools — SIEM, EDR, identity, cloud — are reconciled into a single chain with source attribution on every node.

4 heuristics
03

Causal Attack Chains

Directed graphs, not timelines. Parent-child relationships between events. The chain shows causation, not just correlation.

04

Evidence Grading

PROVABLE, MIXED, or INFERRED at every link. Confidence is measured. Downstream grades inherit upstream uncertainty.

05

Full Path Traceability

From initial access to impact. Every step navigable. Drill into any node and see the source event.

06

Audit-Ready Evidence

Export chains as structured evidence for compliance audits, incident reports, legal proceedings, or board presentations. Every chain includes full source attribution, confidence grades, and temporal metadata.

Where proof changes
the outcome

HIGH RISK

Breach investigation

Your analyst reconstructs the attack in hours instead of days. Every step is sourced. The board gets a chain, not a summary.

HIGH RISK

Compliance and audit

Regulators want evidence, not dashboards. TRA-CE exports graded chains that hold up under scrutiny.

OPERATIONAL

Automated response validation

Before your SOAR fires a remediation playbook, TRA-CE confirms the causal chain that triggered it is provable.

OPERATIONAL

Threat hunting

Hunters follow chains, not alerts. When a behavioral anomaly surfaces, the chain shows exactly what preceded it.

TRA-CE is not a SIEM.
It is the causal layer.

It sits beside your existing stack. It ingests normalized events, builds causal chains, and outputs evidence-graded findings.

TRANSPORT

Avon post-quantum encrypted

All data crosses trust boundaries through Avon — ML-KEM-768 + X25519 hybrid key exchange, ML-DSA-65 signatures, AES-256-GCM encryption. Session keys rotate every 30 seconds.

ISOLATION

Multi-tenant row-level

PostgreSQL with row-level tenant isolation ensures organizations cannot access each other's data. Every query is scoped. Every row is tagged.

COLLECTOR

Lightweight Docker agent

One container inside your network. Connects to your SIEM, EDR, identity provider, or cloud platform. No endpoint agents. No kernel modules.

ENGINE

Four inference heuristics

Explicit evidence, artifact correlation, MITRE technique progression, and temporal analysis. Each edge is graded independently using all four.

See TRA-CE build a causal chain from your own security events.

Request Access →