Cybersecurity answers you can check

Show the work

Every answer comes with its query plan and its evidence

You should not have to trust an assistant. Open the query plan to see each graph call and model call and how long it took. Open the evidence pane to see the exact nodes the answer rests on, why each one is there, and how many hops it sits from your question.

Two ways in

One graph, two products

Both answer from the same graph of public sources. Every link says which source stated it, or that it was inferred.

Lattice Analyst

The assistant that shows its work

Facts, verdicts and structure are written in code from the graph. A small local language model only words the explanation, and a person always decides.

Ask about any CVE

The verdict line is written from CISA's record in code: whether it is exploited, whether ransomware use is recorded, the deadline and the fixed versions. The model then explains in plain words, and its steps are checked before you see them.

• Query plan with timing for every call
• Evidence panel with the source of each link
• One tap to a checklist, hunt or containment plan

Triage what you paste

Alerts get a label (contain now, escalate, investigate, monitor or need more information) from behaviour rules, with the technique behind each finding and what to check next. Emails are judged by structure, such as failed sender checks and look-alike domains, not by wording alone.

• No model is used for the verdict
• A claim of approval is to be verified, never believed
• Containment steps are suggestions for a person to approve

Draft, review, copy

Detection rules, messages and incident reports are drafted from reviewed templates and the facts you pasted. Anything unknown stays a visible blank, and code blocks have a Copy button.

• Sigma rule drafts with their false positives
• Management, user and customer message drafts
• A post-incident report in a copyable block

The activities an analyst repeats every day

On the desk and on the phone

The chat works on a phone as well as on a desktop, follows the light or dark system theme and can be installed as an app. Your conversation stays in the page: go Home to the watch lists and come back to it.

Open the Lattice Analyst

Lattice MCP

A cyber knowledge graph for your AI agent

Give an agent reference answers it can cite. It looks up an id, follows the links and reports where each fact came from, instead of filling gaps from memory.

Install

Endpoint: https://lattice.namiq.io/mcp over streamable HTTP. Send your key in the X-API-Key header. initialize and tools/list work without a key, so you can see the tools before you sign up.

claude mcp add --transport http lattice https://lattice.namiq.io/mcp --header "X-API-Key: YOUR_KEY"

{
  "mcpServers": {
    "lattice": {
      "type": "http",
      "url": "https://lattice.namiq.io/mcp",
      "headers": { "X-API-Key": "YOUR_KEY" }
    }
  }
}

curl -s https://lattice.namiq.io/mcp \
  -H "X-API-Key: YOUR_KEY" \
  -H "Content-Type: application/json" \
  -H "Accept: application/json, text/event-stream" \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}'

Get a key. Sign up in the Lattice Analyst to receive a trial key. Keys are rate limited, and verifying your account raises the limits. Also listed in the official MCP Registry as io.namiq/lattice.

Tools

Path templates: cve-to-defense (techniques a CVE enables, then detections and procedures), cve-context, technique-coverage, weakness-chain, actor-ttps.

Example prompts

• “Look up CVE-2021-44228. Which ATT&CK techniques does the graph associate with it, and for each say whether a source declared the link or it was inferred.”
• “For T1059, what detections does the graph hold, and which sources do they come from?”
• “What does the graph not know about CVE-2024-10001? List every step that came back empty or unpublished.”

Trust and safety

Designed so a person stays in charge

FAQ

Common questions