Aarvi AI · Product
Aarvi Intelligence
The console on top of the Aarvi AI corpus. Alerts, investigation, monitoring and reports share one evidence model, so a finding is the same object wherever you meet it.
- 6
- workflows
- 3
- search channels
- 1
- evidence model
Aarvi Intelligenceone evidence model · three search channelsAlert queue
3 open · 1 assigned- HighRepeated failures, then a successful loginALR-1042 · finance-app-02 · Needs review04:02
- MediumUnusual application access outside baselineALR-1041 · app-gateway-01 · Investigating03:47
- LowUnexpected service restart on a worker nodeALR-1040 · worker-03 · Needs review03:12
Illustrative interface. Records are invented; no customer data is shown.
Workflows
Six entry points. One set of evidence.
You can start from an alert, a phrase, a watch subject or a blank report form. The platform hands back the same thing each time: a record, its source, and the moment it was captured.
SIEM & intelligent alerting
- logs
- Sentinel V2
- Laya DCO
- human review
What you do
Review an alert that already carries the events it was built from, and decide what to do about it.
What the platform does
Sentinel V2 reads normalised telemetry. Laya DCO decides whether the observation becomes an alert, stays correlated or is dropped. The alert arrives with a timeline, affected entities, the model's reasoning and Nano V2.1's intelligence context.
The open-source SIEM engine is not selected yet, so this workflow is planned rather than shipped.
Continuous threat intelligence
- crawler
- actors
- indicators
- provenance
What you do
Query an indicator, an actor or a phrase, and read the source behind every claim.
What the platform does
Maintenance jobs keep actor, campaign and indicator records current. Every record keeps first-seen, last-seen and the source that asserted it, so a match is evidence rather than a mention.
Live dark web investigation
- Nano V1.2
- orchestrator
- Oracle Cloud
- live scan
What you do
Type the phrase you care about and wait for a fresh crawl, instead of trusting an index that was built last quarter.
What the platform does
Nano V1.2 expands the phrase into the variants a search actually needs. The orchestrator selects configured sources, workers collect, and results are deduplicated with your original phrase highlighted and expanded matches labelled as such.
Only configured and reachable sources are searched, and a scan reports partial coverage rather than hiding it.
Indexed & Telegram search
- dwsearch.online
- Telegram
- indexed
- capture time
What you do
Search millions of pages in seconds, or the Telegram messages already collected, when speed matters more than freshness.
What the platform does
dwsearch.online serves the stored dark web corpus from Google Cloud. Telegram search queries the pre-crawled message store. Neither performs a live scrape at query time, and both show capture times so freshness is never implied.
Telegram search is in development. It queries collected messages, not a live channel.
Monitoring & Info Cards
- Info Cards
- schedules
- three channels
What you do
Put an organisation, a domain, a person or a credential fingerprint under a recurring watch and stop re-typing the same search.
What the platform does
An Info Card becomes search intent. A schedule runs it daily, weekly, monthly or on a custom cadence across any of the three channels, and delivers a report to email or a configured integration.
Researched reports
- 20-word intake
- Nano V2.1
- verification
What you do
Describe what you need in twenty words, choose a use case and a report structure, and get on with your day.
What the platform does
Planning, cross-channel research, section evidence, Nano V2.1 synthesis, verification, delivery. Every substantive claim keeps a citation and a collection time, and gaps are stated rather than filled.
Twenty to thirty minutes is a target measured against scan scope, queue depth and source availability — not a guarantee.
The record
Every answer is a record with a receipt.
This is the object the whole console is built around. It is not a search result and not a model output: it is a capture, its provenance, and a bounded claim about what it means.
Capture · indexed corpus · dwsearch.online
- Captured 2026-10-14 03:44 UTC · job crawl-7f21
- Domain list posted to a broker thread · 412 entries
- Matched phrase: northwind logistics (original)
- Expanded variant: northwind-logistics · labelled
- Neighbour entry: northwind-supply · not an exact hit
- Publisher: m4rble · first seen 2025-11-02
- Channel: indexed corpus · no live scan at query time
Redacted at render. Ordering and spacing preserved from the capture.
- Source
- dwsearch.online · indexed
- Capture
- 2026-10-14 03:44 UTC
- Fetch job
- crawl-7f21
- Extractor
- v4 · domain, email, alias
- Confidence
- high · exact domain
- Retention
- per engagement, stated in contract
What this supports
That this domain appeared in the listed material on the capture date, and that the match is against the phrase you asked for.
What it does not
Prove a breach, a live session or that the publisher is the actor behind the original listing. Those need a separate observation.
One record, shown the way the console shows it. The original phrase is highlighted; a near match is labelled as such rather than counted as a hit.
Models
Where each model sits in the journey.
Models are used where a decision genuinely needs judgement, and deterministic services do everything that does not.
| Workflow | Model | Decision |
|---|---|---|
| SIEM alerting | Sentinel V2 · Laya DCO | Whether telemetry is suspicious, and whether it becomes an alert |
| Live investigation | Nano V1.2 | What variants of your phrase are worth searching |
| Alerts, summaries, reports | Nano V2.1 | What the evidence means, in language an analyst can sign |
| Everything else | Deterministic services | Retrieval, deduplication, scheduling and delivery |
Status
What is live, and what is not.
A buyer should be able to tell the difference without opening a contract. These four columns are the same on this page, on the homepage and in the footer.
- dwsearch.online
- Dark web orchestrator
- Continuous collection
- Nano V2.1
- Nano V1.2
- Telegram search
- Free AI reports
- Sentinel V2
- Laya DCO
- Integrated SIEM
- Alert pipeline
Deployment
Your data does not become someone else’s corpus.
Collection runs on infrastructure we operate. Your logs, Info Cards, searches and reports stay in a scoped deployment, with retention and residency agreed before the first query runs.
Tenancy, residency and retention are decided per engagement, not assumed by a pricing page.
Security & trust- dwsearch.online
- Google Cloud · indexed corpus
- Orchestrator
- Oracle Cloud · live dark web scans
- Model serving
- Deployment-dependent · versioned per release
- Collection
- Owned crawlers and maintenance jobs
- Delivery
- Email and configured integrations
Index
Jump to a workflow.
Same six, in the order an investigation usually meets them.
- 01SIEM & intelligent alertingDevice telemetry becomes an evidence-backed alert, a human decision and an audit trail.logsSentinel V2Laya DCO
- 02Continuous threat intelligenceAlways-on collection builds the IOC, actor and campaign corpus that everything else reads.crawleractorsIOCs
- 03Live dark web investigationOne phrase becomes an expanded query plan, a fresh crawl and highlighted findings.Nano V1.2orchestratorlive
- 04Indexed & Telegram searchFast retrieval from what has already been collected, with capture times attached.dwsearchTelegramindexed
- 05Monitoring & Info CardsA watch subject, searched daily, weekly or monthly across three channels, delivered by email.schedulesInfo Cardsemail
- 06Researched reportsA twenty-word brief becomes a structured, cited report on a twenty-to-thirty minute target.Nano V2.1verificationemail
Access
See it against your own question.
Tell us what you would search for on your worst day. We will run it, show you the evidence, and tell you honestly what the corpus does not cover.
Sentinel V2, Laya DCO and the SIEM integration are planned. They are not part of a current deployment.