annaconda watches an endpoint as an attack unfolds and seals a reproducible, MITRE-mapped verdict. A fleet of Gemini agents drives and explains the investigation — but the language model is out of the decision path.
The one invariant. The deterministic engine produces and seals the verdict before any model describes it. Swap the narrator — Gemini, another model, none at all — and the verdict, its score, and its hash never change. That is what makes the result reproducible bit-for-bit, and defensible.
Live telemetry is frozen into sealed evidence windows, adjudicated by a deterministic core, and chained into a tamper-evident record.
Curated Velociraptor VQL collects endpoint telemetry. No raw queries — only vetted hunts.
Telemetry is frozen into an immutable, SHA-256-sealed evidence window.
The deterministic core scores it — no floats, no model — and maps findings to MITRE ATT&CK.
Each verdict is chained onto the previous. Tamper with any link and verification fails.
The agent explains the sealed verdict to the examiner — exactly, never altering it.
All built on Google's Agent Development Kit and Gemini. The verdict is always the sealed engine's.
Woken by Cloud Scheduler, it reads what earlier cycles found, tasks the specialists it is cleared to task, and decides when to look again, when a human is needed, and when to stop. It holds no collection or adjudication tool of its own — it can only task those who do.
Watch a cycle →Chooses which hunts to run, decides when to freeze and adjudicate a window, and narrates the sealed result. Its tools give it no way to pass a score or a hash — no way to touch the verdict.
Open the exhibit →A patient advisor: explains DFIR methodology, MITRE techniques, and what each verdict state means — grounded in real knowledge, never invented. It teaches you to reason; it never concludes for you.
Ask the mentor →Every investigation run continues the case's sealed chain. Each entry commits to the one before it, so the whole case verifies as a single tamper-evident record — reorder, alter, or drop a link and it breaks.
The spine on the right is that structure made visible: an unbroken line is a passing verification.
On the exhibit, press Run sealed investigation. annaconda freezes evidence windows and seals a verdict for each. Or let Gemini drive and narrate.
Each window shows its sealed state, exact score (a fraction, never a float), MITRE techniques, and the chain of custody — prev → window → entry.
Press Replay & re-verify seals. annaconda re-derives every seal from the recorded windows and confirms they match. Determinism, demonstrated.
On the fleet console, press Run a cycle — the code path Cloud Scheduler runs at 3am. Switch the running department and watch the catalog refuse an over-reach.