TaegisAnalystPocket

TAPocket puts your Secureworks Taegis XDR detections in your pocket. It answers the three questions worth asking away from a desk: what has fired, what is waiting on me, and am I blind anywhere. It talks to the Taegis API directly from your device. There is no intermediate server, no account to create, and no copy of your detection data anywhere but your phone and Taegis. TRIAGE THE QUEUE Open detections from medium severity upward, sorted by severity, with filters for severity floor, open status and time window. Open one for its entities, the detector and engine behind it, the ATT&CK technique and any linked investigations — then resolve it with a reason. ANSWER WHAT IS WAITING ON YOU Count tiles for total, open, active, awaiting action and suspended, counted by the server across your whole case set rather than one page. Awaiting action is the state that justifies carrying this on a phone: it means the SOC is blocked on you. Case key findings render in full, tables included. Comment on a case, or close it with the right resolution. SEE YOUR BLIND SPOTS A source that stopped sending looks exactly like a quiet night. TAPocket puts source health directly under the detection counts, defaults the list to the problems, and groups by collector — several dark sources behind one collector is one problem, not several. Seven days of ingest volume per source, because for a feed that died three days ago a 24-hour chart is a row of zeros. CHECK AN ENDPOINT Hostnames, addresses, OS build, sensor version, last connected, tags, and both the reported and the requested isolation state — so the app never claims a host is contained while the request is still in flight. TWO WAYS TO CONNECT, PER TENANT Sign in as yourself through your organisation's SSO, and your own Taegis role, MFA and conditional access all apply while only a short-lived token sits on the device. Or use an API client credential for a tenant where you have no user account. You choose per tenant, and the app tells you plainly what each choice costs before you make it. BUILT FOR DATA THAT MATTERS - Your Taegis roles decide what you can do — Taegis stays the authority - Sign-in happens in the system browser on the real Secureworks domain - Face ID or Touch ID to open, and again before any write - Secrets in the iOS Keychain, never in iCloud Keychain or a backup - Offline caching off by default - One tap clears every tenant, token and secret from the device TRY IT PROPERLY Demo mode works immediately, with no Taegis account, so you can walk every screen before connecting anything. The app itself is free: no in-app purchases, no subscription, no paid tier — and no analytics SDK, no advertising SDK and no server of ours in the path. WHAT IT DOES NOT DO It is not a pager. Real push notifications would need a server holding a credential, and TAPocket has no server by design — it polls while open. And it will not isolate a host: containment is deliberately not a phone-sized decision. REQUIREMENTS A Secureworks Taegis XDR tenant, and either a user account in it or an API client credential for it. All Taegis regions supported, chosen per tenant. iOS 26 or later. TAPocket is an independent client and is not affiliated with, endorsed by or sponsored by Secureworks. Secureworks and Taegis are trademarks of Secureworks, Inc., used only to describe what this app connects to.