Security & IT Systems
Network Security
- Antivirus Engine
- B/B
- WAF
- FW / UTM
- DDoS
- TMS
Server / Endpoint
- Web / WAS
- DB
- ERP
- AV
QUADX
AI-powered Open XDR security operations platform
QUADX is a security operations hub that integrates SIEM, TIP, SOAR and SIRP. Using the context data (including original evidence) generated by Network Blackbox, AI analyzes true and false positives of detection events and automates incident response based on playbooks.
QUADX Architecture
Pursuing eXplainable Security (XSec) grounded in definitive evidence, QUADX systematizes proactive threat response
QUADX collects diverse logs and network data, analyzes and responds through the Console and Sensor, and connects everything into a single flow — down to automated response on confirmed detections.
System Configuration
From detection to response — automating the entire security operations workflow in a single console
External Solutions
3rd Party SIEM
and other
security operations solutions
- AI-based Ticket Auto-Analysis & Visualization
- Threat Intelligence Analysis & Management
- Automated Incident Response
- Incident Investigation Playbook
- Detection Evidence Capture
- TTP-based Threat Hunting
- Deep Network Analysis
- Full-Packet Capture & Storage
Network Traffic
- Metadata
- Flow
- Header
- File, Mail, Contents
- Payload
Optional data collection supported
Automated response on confirmed detection (REST API / App) QUADX Security & IT Systems
6 Core Capabilities
01 Console
Correlation & AI/ML Threat Detection to Incidents
Detects threats with H LAB-defined correlation rules and 6+ AI/ML models, links them into incidents, and supports GUI-based model tuning
02 Sensor Integration
Original-Evidence-Based True/False-Positive Analysis
AI automatically searches and compares the context data generated by Network Blackbox (including original packets and files) to assess validity and impact
03 Console
Threat Intelligence Platform (TIP)
A platform operated by H LAB that collects and refines OSINT into organization-tailored detection rules and updates them to the Defense Center (TAXII/STIX supported)
04 Console
Dashboards & Playbook Workflows
Workflows with customizable dashboards, drill-down, sub-playbooks, version control and rollback automatically configure blocking and isolation per incident type and apply the latest playbooks in real time
05 Console
App Store Extensibility
Integrates with 100+ security products and IT apps with one-click installation
06 Console
Unified Incident Response Console
A single-screen unified view including PCAP and files supports the entire automation process and analyzes 122 types of forensic artifacts
QUADX
Integration with diverse SOC platforms
Combines network context data and analytical capability with your existing security operations environment.
SIEM integration
Threat analysis that links logs with network context data
SOAR integration
Linking threat analysis with response workflows
XDR integration
Adding network context to multi-domain threat analysis
SOC portal integration
Using context data and analysis results on a unified operations screen
Common sensor Network Blackbox Provides context data
Expected Benefits
The impact of adopting QUADX
Higher security-operations efficiency through context data and SOC integration
- Operational efficiency
Less repeated checking and manual work
Eases duplicate checking and manual effort by linking context data with analysis results
- Response speed
Shorter threat-assessment and response time
Connects threat analysis with response procedures to reduce delay from judgment to action
- Decision confidence
Stronger evidence-based judgment
Threat analysis and response decisions that combine logs with network context
- Existing-investment leverage
Higher use of your existing SOC
Broadens analytical use of existing SIEM, SOAR, XDR and the SOC portal