Torq

Torq is an AI SOC Platform combining two layers: Hyperautomation — a deterministic workflow engine for building SecOps automations — and HyperSOC — an agentic layer in which artificial intelligence (Socrates) acts as an additional SOC operator. The platform covers the full incident lifecycle: triage, data enrichment, investigation, and response, integrating natively with SIEM, EDR/XDR, IAM, cloud, and threat intelligence systems. Torq provides a native Case Management module as the central source of case information (evidence, timeline, summaries).

Torq is delivered in a cloud-native SaaS model. Workflows are built with no-code/low-code or by describing intent in natural language, which the Socrates module translates into deployable automations and agent configurations. Instructions for the Socrates agent are built in natural language rather than as rigid instructions — this distinguishes them from classic SOAR playbooks. The platform provides a library of integrations and ready-made steps for building automations.

MORE INFORMATION: https://torq.io/

Description of technology

SOAR/SOC

Case Management - a native platform module serving as the source of events requiring intervention or monitoring (evidence, timeline, case summaries), which simplifies collaboration between analysts at different tiers and reporting to management and audit.

HyperSOC - an agentic overlay in which Socrates acts as the orchestrator coordinating specialized AI agents (HyperAgents): the Runbook Agent (turns natural-language instructions into ready-to-run automations), Investigation Agent (data enrichment and root-cause analysis of an incident), Remediation Agent (executing corrective actions across integrated systems), and Case Management Agent (real-time case tracking and prioritization). Runbooks are semantic in nature — they are instructions for Socrates rather than executable playbooks in the classic SOAR sense, allowing response logic to be modified faster without rebuilding the entire workflow.

Hyperautomation - a deterministic workflow engine (triggers, steps, integrations, webhooks) responsible for repeatable, rule-based operations: event deduplication, data normalization, enrichment, and escalation. This means routine tasks that would otherwise reach Tier-1 are handled automatically, allowing analysts to focus on cases requiring expert judgment.

Helpful files