Machine-vs-human scoring
Every cluster gets a calibrated verdict — hand-run, LLM-orchestrated, or fully autonomous agent — with the evidence behind it.
NORSESTAR
NORSESTAR
Valkyrie is the AI layer of the DarkWatch platform. It reads 1.3 billion events a day so your analysts don't have to — clustering campaigns, flagging machine-generated attacks, and drafting the investigation before anyone opens a ticket.
Attackers now run on language models and autonomous agents. Valkyrie is built to recognize that — separating hand-run intrusions from machine-generated ones and handing your team a head start instead of a backlog.
Every capability points at one goal: fewer windows open, faster decisions, and a clear line between human and machine adversaries.
Every cluster gets a calibrated verdict — hand-run, LLM-orchestrated, or fully autonomous agent — with the evidence behind it.
Related activity across sensors and time collapses into a single named campaign you can track as one object.
Ask in plain English across all DarkWatch telemetry — no query language, no schema spelunking.
Valkyrie writes the first draft: timeline, affected assets, indicators, and recommended next steps for you to edit.
Pulls RuneFeed context and Yggdrasil pivots straight into the triage view.
Every Valkyrie suggestion is tracked and reversible, so the human stays accountable for the call.
Four stages turn raw sensor telemetry into an investigation an analyst can act on.
Valkyrie consumes the full DarkWatch stream from the Bifrost grid — 1.3B events a day, enriched in flight.
Related events across sensors and time collapse into coherent, named campaigns instead of isolated alerts.
Each campaign is scored hand-run, LLM-orchestrated, or autonomous agent — with calibrated confidence.
Valkyrie drafts the investigation — timeline, assets, indicators, next steps — for an analyst to review and own.
Valkyrie's detection and drafting models are served from NorseStar's internal model registry at models.internal.norsestarsecurity.com, maintained by the Threat Research team. Model cards and evaluation sets are available to Enterprise customers under NDA.
Start with a single seat; scale to shared workspaces, custom classifiers, and private model access.
Analyst
Single seat
Team
Shared workspace
Enterprise
Org-wide
Currently shipping Valkyrie 2.3. Highlights from recent releases.
Triage is one layer. These products feed Valkyrie and act on what it finds.
The global attack map
Renders every attack the sensor grid sees, in real time, with AI-attack fingerprinting — the screen on the SOC wall.
Explore DarkWatch Live ▸Global collection grid
Passive sensors, honeypots, and dark-IP listeners that capture the raw attack traffic Valkyrie reads.
Explore Bifrost ▸Curated threat feeds & API
Enriched indicators and AI-attack signatures delivered as STIX/TAXII, a REST API, or native SIEM connectors.
Explore RuneFeed ▸Attribution & infrastructure graph
Connects every indicator — domains, certs, ASNs, wallets, operators — into the whole adversary tree.
Explore Yggdrasil ▸Thirty minutes with a NorseStar intelligence engineer and a live look at how Valkyrie clusters and classifies what our sensors already see hitting your sector.
Request a demo ▸