Garudon
Give every investigation a clear question and a recorded history. Garudon organizes security and incident investigations into structured cases with explicit scope, transaction and account references, revision history, and recorded outcomes.
Incident investigations lose their reasoning when they happen in chat rooms
When an alert fires or an unusual transaction appears, responders paste hashes, addresses, and hypotheses into an ephemeral channel. Hours or weeks later, it is difficult to reconstruct what question was actually asked, which transactions and accounts were examined, how the scope changed, or why the case was closed.
Frame the question
Open a case around a stated investigation question, target network, affected protocol or asset, and the block or time window under review.
Attach references
Link transaction hashes, account and contract addresses, Radar alerts, or Protect assessment references to the case.
Track revisions
Every update to the question, scope, or attached references creates a numbered revision so the team can see how the investigation evolved.
Record the outcome
Close the case with an explicit disposition — confirmed incident, authorized operation, false positive, or inconclusive — and a written rationale.
What is available today and what is not yet available
Garudon provides a structured case and revision ledger today. Deeper automation and export capabilities remain planned and are marked clearly below.
Cases and investigation scope
Create a structured investigation case with a title, primary investigation question, priority, status, and bounded chain, protocol, and block-range scope. Available today.
Transaction and account references
Attach typed seed references to a case — including on-chain transactions, accounts, contracts, Radar alerts, and Protect assessments — with responder notes explaining why each item matters. Available today.
Revision history
Every change to the investigation question, scope, references, or status is recorded as a numbered revision with author and timestamp so the progression of an investigation is never overwritten. Available today.
Recorded outcomes
Record a structured outcome and disposition when resolving or pausing a case, capturing the conclusion and supporting rationale for post-incident review or compliance records. Available today.
Automated evidence import and causal graphs
Automatic ingestion of on-chain traces into a case and structured causal investigation graphs are planned capabilities and are not available today.
Direct replay integration and bundle exports
One-click launch into an Auditing IDE replay session from a case and portable evidence bundle exports are not available today.
An auditable record of what was investigated and why
When a monitoring alert flags an unexpected implementation slot change on a treasury proxy, the response team opens a Garudon case. Every responder sees the same question, the same referenced transactions and accounts, the revision history as scope narrows, and the final recorded disposition.
- Revision 1 · Case opened
- Revision 2 · Scope bounded
- Revision 3 · References added
- Revision 4 · Outcome recorded
Designed for teams that investigate alerts, incidents, and high-risk activity
Protocol security teams
Turn Radar contract-change alerts into scoped cases, verify whether an admin or implementation change matched an approved proposal, and keep a permanent record of the decision.
Exchanges and listing teams
When a listed token or bridge contract exhibits an unexpected upgrade or privileged call, track the investigation scope, relevant transactions, and disposition for listing and risk committees.
Auditors and incident responders
Maintain a clean revision history of hypotheses, examined transactions, and conclusions during a live inquiry or post-mortem review.
What Garudon covers today and what remains planned
Garudon focuses on structured case management, scope, references, revisions, and outcomes.
- Case lifecycleAvailable. Create, scope, update, and resolve investigation cases with explicit questions and dispositions
- Typed referencesAvailable. Reference transactions, accounts, contracts, Radar alerts, and Protect assessments within a case
- Revision trackingAvailable. Append-only revision history across case edits, reference additions, and outcome updates
- Automated evidence importNot available. Traces and external evidence are referenced manually today
- Causal investigation & replay linkNot available. Causal claim graphs and direct replay handoff into Auditing IDE are not available
- Evidence bundle exportsNot available
Walk through Garudon with your security team.
Book a demo to see how Garudon pairs with Radar monitoring and Protect assessments for structured investigation workflows.