Features · deep dive

Every feature built for how MSSP security operations actually run.

Multi-client rotations, SLA-enforced coverage, fairness your analysts can see, and handover notes that keep nothing between shifts. No generic scheduling tool has these because no generic scheduling tool was built for this.

Last updated: June 2026
01 · Auto rotations

A constraint solver, not a template.

Define your shift model per client account: hours, minimum staffing, tier requirements, rest windows, fairness target. The solver generates a valid rotation across all your teams in under a second and surfaces every constraint it had to relax - before you publish.

  • Day · Evening · Night · Weekend × any cycle length
  • Hard rules: coverage, rest, tier minimums, blackout dates
  • Soft rules: fairness, weekend rotation, follow-the-sun preference
  • Re-solve on demand without losing manual overrides
Analyst
Hrs
Mon
11
Tue
12
Wed
13
Thu
14
Fri
15
Sat
16
Sun
17
Total coverage
288
5/5
5/5
5/5
5/5
5/5
5/5
6/5
KP
K. Patel
L3
40h
08:00-
16:00
Patel · L3
08:00-
16:00
Patel · L3
08:00-
16:00
Patel · L3
08:00-
16:00
Patel · L3
16:00-
00:00
Patel · L3
AO
A. Okafor
L2
48h
16:00-
00:00
Okafor · L2
16:00-
00:00
Okafor · L2
16:00-
00:00
Okafor · L2
16:00-
00:00
Okafor · L2
08:00-
16:00
Okafor · L2
08:00-
16:00
Okafor · L2
MC
M. Chen
L2
56h
00:00-
08:00
Chen · L2
00:00-
08:00
Chen · L2
00:00-
08:00
Chen · L2
16:00-
00:00
Chen · L2
16:00-
00:00
Chen · L2
16:00-
00:00
Chen · L2
16:00-
00:00
Chen · L2
JL
J. Lindqvist
L2
56h
08:00-
16:00
Lindqvist · L2
08:00-
16:00
Lindqvist · L2
16:00-
00:00
Lindqvist · L2
08:00-
16:00
Lindqvist · L2
08:00-
16:00
Lindqvist · L2
00:00-
08:00
Lindqvist · L2
00:00-
08:00
Lindqvist · L2
SR
S. Reyes
L1
40h
08:00-
16:00
Reyes · L1
00:00-
08:00
Reyes · L1
00:00-
08:00
Reyes · L1
08:00-
16:00
Reyes · L1
08:00-
16:00
Reyes · L1
RB
R. Bauer
L1
48h
16:00-
00:00
Bauer · L1
16:00-
00:00
Bauer · L1
Leave
Approved
16:00-
00:00
Bauer · L1
08:00-
16:00
Bauer · L1
16:00-
00:00
Bauer · L1
00:00-
08:00
Bauer · L1
02 · Coverage radar

See the gap before it goes live.

Every shift carries a minimum-coverage rule. The radar surfaces drops in real time: when leave is requested, when a swap is proposed, when an analyst is added or removed. No more discovering Wednesday-night was a solo shift the week after.

  • Per-shift minimums (e.g. 2 L2 + 1 L1 on Night)
  • Pre-publish gate: rotation can't ship with red shifts
  • SLA history & rolling 90-day coverage report
  • Webhook on coverage breach to your incident channel
MON
13
TUE
14
WED
15
THU
16
FRI
17
SAT
18
SUN
19
DAY
3
3
3
3
0/2
3
3
EVE
2
2
1/2
2
2
2
2
NGT
1
1
1
1
1
1
1
min coverage / shiftDAY 2 · EVE 2 · NGT 1
current breachDAY Fri · 0/2 · EVE Wed · 1/2
coverage this week83%
gaps2
03 · Leave with impact preview

Approve or deny, but always with the numbers.

When an analyst requests leave, the manager sees exactly which shifts are affected, how coverage drops, and which colleagues are eligible to backfill. The rebalance plan is one click away.

  • Same-day, half-day, multi-day, recurring
  • Coverage impact per shift before approval
  • One-click auto-rebalance with fairness preview
  • Coverage impact shown before approval - not after
13 May 2026Evening14:00-22:001 still covering · min 2BELOW MIN
J. LindqvistL2 · OFF that day · drift +0h
RECOMMENDED
D. HassanL1 · OFF that day · drift +1h
rest risk
M. ChenL2 · Working · drift −1h
already working
04 · Two-stage swaps

Peer-first, manager-final.

Analyst proposes a swap from their schedule. Eligible colleagues are pre-filtered (coverage, rest, tier). The chosen colleague accepts, manager gets a single approval with fairness and coverage delta visible.

  • Direct swaps & open-market swaps
  • Auto-eligibility filter (rest, tier, coverage)
  • Fairness ledger updates on approval
  • Full audit trail per request

M. Chen ⇄ S. Reyes

swp-118submitted 13 May 2026
APPROVAL STAGES
1. PROPOSED
M. Chen
NIGHT · Fri 13 May
2. PEER REVIEW
S. Reyes
Accepted
3. MGR APPROVAL
Manager
Awaiting your approval
IMPACT CHECKS
Rest check✓ both parties
Initiator shiftNIGHT · Fri 13 May
Counterparty shiftDAY · Sat 14 May
Peer responseaccepted
FAIRNESS IMPACT
M. Chengives NIGHT (+1h) → takes DAY (0h)net −1h · 90d balance: 4h (drift −0.3h)
S. Reyesgives DAY (0h) → takes NIGHT (+1h)net +1h · 90d balance: 3h (drift +0.3h)
05 · Fairness ledger

The unsociable-hours debt nobody was tracking.

Every shift carries a configurable weight. The ledger maintains running totals per analyst over rolling windows. The next rotation gives weekends and nights to whoever is most owed. No more "the same people always get Christmas."

  • Per-shift weight (night ×1.6, weekend ×1.4, holiday ×2.0, configurable)
  • Rolling 30/60/90/365-day balance
  • Drift target enforced by the solver
  • Visible to analysts for full transparency
AnalystRoleNGTEVEWKDUnsoc. hDrift (avg 15.6h)
K. PatelL346318.2h
+1.1h
R. BauerL135316.6h
+0.6h
M. ChenL225215.2h
+0.2h
J. LindqvistL224214.8h
−0.2h
A. OkaforL224214.6h
−0.4h
S. ReyesL123214.4h
−0.6h
NEXT ROTATIONS. Reyes gets priority for nights & weekends (−0.6h drift, most owed). K. Patel will receive a lighter unsociable load (+1.1h).
06 · MSSP multi-tenant

One workspace. Many SOCs. Isolated data.

Built for MSSPs running rotations for multiple client SOCs. Each tenant has its own shift model, calendars, analysts, and audit trail; managers can jump between tenants without losing context.

  • Per-client shift models, calendars, and rules
  • RBAC: analysts see only their tenant; managers see all
  • Consolidated billing across tenants
  • SAML SSO + SCIM provisioning
prodACME-MSSP · Internal14 analysts
clientNorthwind CSIRT8 analysts
clientContoso Financial SOC12 analysts
clientInitrod Security6 analysts
07 · Shift handover notes

Nothing falls through the gap between shifts.

Before clocking off, the outgoing analyst logs open incidents, active threat hunts, and any escalation context the next shift needs. The incoming analyst sees it the moment they log in, structured, searchable, and linked to the relevant shift record.

  • Structured template: open incidents · active hunts · escalations · notes
  • Linked to the shift record and analyst fairness log
  • Searchable history: find what was handed over on any past shift
  • Reminder fires 30 min before shift end if notes are incomplete

NightWed 13 May 2026

by R. Bauerupdated 13 May · 05:51 UTC
OPEN INCIDENTS
INC-4821: lateral movement alert, under investigation. INC-4834: phishing campaign, contained, monitoring.
ACTIVE HUNTS
Hunt-19: anomalous outbound DNS on subnet 10.4.x, no match yet, query saved in SIEM.
ESCALATION CONTEXT
None pending.
GENERAL NOTES
Customer A ticketing system was slow overnight, delays in auto-close, not a breach.
Want a guided tour?

See it on your own rotation in 30 minutes.

Tell us how your SOC is structured. We'll build a compliant rotation live, walk through coverage and fairness, and answer the SOC-specific questions your IT generalist tool doesn't.

  • Demo length30 minutes · built around your setup
  • Trial30 days · full feature access
  • OnboardingGuided setup · same-day live