SOC Workstation

The SOC Workstation is the primary interface during Shift Mode. It replicates a multi-monitor SOC environment within a single browser window, giving you simultaneous access to SIEM, XDR, Firewall, Threat Intelligence, Case Management, and Comms panels.

Layout Presets

Four layout presets let you configure your workspace for different stages of an investigation:

Switch between presets with Ctrl+Shift+L or through the layout selector in the taskbar.

Window Management

Each tool window supports standard window operations:

• Tiling -- Windows snap to predefined grid positions. Drag a window to the edge of the workspace to tile it.
• Detaching -- Press Ctrl+Shift+D to pop a window into a separate floating panel. Useful for multi-monitor setups.
• Minimizing -- Minimize windows to the taskbar. Click the taskbar button to restore them.
• Resizing -- Drag window borders to resize. Double-click a border to expand to fill available space.

Cross-Window Pivoting

When you encounter an IOC (IP address, domain, hash, process name) in any tool window, right-click it to open the pivot menu:

• Open in SIEM -- Search logs for this indicator
• Open in XDR -- Search endpoint telemetry for this indicator
• Open in Firewall -- Search connection logs for this indicator
• Open in Ember ThreatInt -- Look up threat intelligence for this indicator
• Pin to Case -- Add this indicator as evidence to your current case

Cross-window pivoting is the fastest way to correlate activity across tools. When an alert in the SIEM references a suspicious IP, pivoting to the Firewall immediately shows whether that IP has other connections.

Taskbar

The taskbar runs along the bottom of the workstation and provides:

Mobile and Tablet

On screens narrower than 1024px, the workstation falls back to a tab-based interface. Each tool occupies a full-screen tab, and you switch between them using the bottom navigation bar. Cross-window pivoting still works -- selecting "Open in SIEM" switches to the SIEM tab with the search pre-filled.