Lumina Signals (Beta)
AI-powered security signals, proactively surfaced across your entire environment
Lumina Signals is a daily feed of decision-ready security risk signals, surfacing what Sola's autonomous intelligence layer detected and prioritized across your connected data sources.
Each day, Sola analyzes your entire environment and surfaces what matters most right now. Every signal has already been investigated before it reaches you, arriving with context, reasoning, and recommended actions pre-assembled, ready for your team to act on.
Sola understands every resource and the connections between them, identifying deviations and risk patterns, and grouping related assets into signals. Each signal represents a compression of thousands of data points into a focused set of meaningful risk clusters, scored and prioritized based on what each asset means to your organization.
The most critical signals are surfaced in your daily feed. This is a live feed that changes with your environment, not an alert queue. There are no open or closed states. If a risk is resolved, it disappears. If it persists, it reappears.
Lumina signals operate at the workspace level, giving you a unified view across all your connected data sources.
Lumina Signals is available on paid plans.
What makes Lumina Signals different
Intelligent grouping: thousands of findings compressed into meaningful risk clusters
Cross-domain: all connected sources analyzed as one unified environment
Business context: risk scoring specific to your organization, not a generic average
Always fresh: daily analysis, live feed, reflects your environment right now
Pre-investigated: every signal arrives with context, reasoning, blast radius, and recommended actions already assembled
Navigating Lumina Signals
Lumina Signals includes three main views:
Overview - A visualization of your environment and the risks Sola detected, from connected data sources through risk reasoning and pattern grouping to AI-contextualized clusters, with a full severity breakdown.
Matrix View - A Risk vs. Anomaly scatter plot for visual prioritization across your insights.
Signal List - A ranked list of the top signals surfaced for your environment.
How Lumina Signals works
Lumina Signals is powered by Sola's intelligence layer, a combination of AI reasoning, graph analysis, and security domain expertise that processes signals across all your connected data sources.
Each day, Sola runs the following process:
The result: A curated, prioritized feed of the most critical signals across your entire environment, in one unified view.
Context
Sola uses business context to understand your environment.
Business context is a set of AI-inferred labels describing each asset's role, environment, and exposure profile. These labels are a key part of what makes risk scoring specific to your organization, rather than a generic industry average.
Context adjusts severity scoring in both directions. A finding can be amplified (for example, from High to Critical if the asset is production-critical) or downgraded (for example, from Critical to High if it applies to a non-production environment). When context changes a finding's severity, the signal shows both the original and adjusted score.
Business context
Business context labels are inferred automatically from asset configurations, tags, names, and relationships, factoring in business function, data sensitivity, environment classification, and blast radius. They reflect what each asset actually is, how critical it is to the business, and how far a compromise could spread.
Labels are displayed in Category: Value format, for example:
Environment: ProductionControl Role: OrchestratorData Type: Regulated / SensitiveBlast Radius Category: Identity Control Plane
Click any label on a signal to see the AI reasoning behind it, including why it was assigned and how many assets it applies to.
Adding business context
Sola infers business context automatically, but you can add context it cannot learn on its own, such as naming conventions, environment classifications, or asset priorities specific to your organization. When you add context in plain language, Sola maps it to the same business context labels and applies it across your environment, adjusting severity scoring for the affected signals.
When change apply
Context takes effect from the next daily analysis. Changes you add today will be reflected tomorrow.
Click Add context to open the Context window.
Each entry includes:
Description
The plain-language input describing this context rule, as entered by the user.
AI Description
The context rule as Sola interpreted and applied it.
Category
The type of business context defined, such as environment type, resource role, or data type. For example: Environment, Functional Role, Control Role.
Impact / Value
The value assigned to the selected category and how it affects risk scoring across your assets. For example: Production, Core Business Function, Orchestrator.
Applies to
Where this context applies: all resource types (Global) or a specific type, such as aws_s3_bucket.
Affected Signals
The signals affected by this context rule.
Context type
The category of context this rule belongs to.
Created by
Who added the context entry.
Reviewing the signal list
The Signal List displays your top signals ranked by risk score, available in card view or table view.
Each signal card highlights the most important details you need at a glance, including the Sola Risk Score, signal title, connected data sources, number of assets and findings, and when the signal was last calculated.
Exploring a signal
Click any signal to open a detailed breakdown across five tabs: Overview, Business context, Assets, Findings, and Graph view.
Every signal panel shows the Name, Sola Risk Score, and Labels at the top, visible across all tabs. The Sola Risk Score is a 0–10 score where the color indicates severity level: Critical, High, Medium, Low, or Info.
1. Overview
The Overview tab gives you a full overview of the detected risk, the assets involved, and the recommended steps to address it.
Summary
A description of what was detected and why it matters.
Integrations
The connected data sources associated with the signal.
Asset type
The type of resource from your connected data sources at the center of this signal, such as a user, role, or cloud resource.
Configuration anomaly
How statistically unusual the asset's configuration is compared to similar assets: Baseline, Moderate, Strong, or Extreme.
Business context
AI-inferred labels describing the role, environment, and exposure profile of the assets involved. Click any chip to see the full detail in the Business Context tab.
Recommended Remediations
Recommended steps to address the risk, listed in order of priority.
2. Business context
The Business Context tab shows the labels assigned to assets in this signal and the reasoning behind each one.
Labels are displayed as chips in the format Category: Value, for example: Control Role: Orchestrator or Environment: Development.
Click any label to see the AI reasoning behind it, including why it was assigned and the number of assets it applies to.
To refine business context with your own organizational knowledge, click Add context from the main Lumina Signals page.
3. Assets
The Assets tab shows all assets associated with this signal.
Expand any asset to see its properties. Business context chips are shown inline for each asset. Properties vary by asset type. Use search and filter to narrow down the list.
4. Findings
The Findings tab lists all security findings that contributed to this signal.
Each finding shows the name and severity. Expand any finding to see the full description and risk information.
5. Graph view
The Graph View tab shows a visual map of the assets involved and how they relate to each other. It can be expanded to fullscreen.
Evidence: A visual map of the asset and its relationships.
Attack vectors: How the risk could be exploited.
Blast radius: The potential scope of impact if the risk is exploited.
Acting on insights
Once you've reviewed an insight, there are several ways to act on it.
Recommended Remediations
Each insight includes a prioritized list of recommended steps to address the risk. Review them in the Summary tab and assign or action them as needed.
Save as a query or configure as an alert
From the Findings tab, review the findings that contributed to an insight to understand the underlying risk in detail. From there, save any finding as a query to use in a canvas or workflow, or configure it as an alert to monitor it going forward.
FAQs
How can I get Lumina Signals?
Lumina Signals is available on paid plans. Contact Sola to learn more.
How does Lumina Signals work?
Lumina Signals is powered by Sola's intelligence layer, which processes signals across all your connected data sources daily. For a full breakdown of the process, see How Lumina Signals works.
Who can access Lumina Signals?
Lumina Signals is available to workspace Admins and Owners. At least one data source must be connected to your workspace to generate insights.
What data sources does Lumina Signals support?
Lumina Signals works with any data source connected to your Sola workspace.
Support for third-party security tools is currently not yet part of Lumina Signals. We're working on expanding coverage to include them.
How often is my feed refreshed?
Lumina Signals generates a fresh set of signals every day. Each daily feed reflects the latest analysis of your environment based on your connected data sources.
Why don't I see the same insights every day?
Lumina Signals is a live feed, not an alert queue. Each day's view reflects a fresh analysis of your environment. If a risk is resolved, it disappears. If it persists, it reappears.
Can I customize how signals are scored?
Yes, click Add context to provide organizational knowledge, such as environment type, resource role, or data type, that influences how risks are scored and prioritized.
What is Sola's intelligence layer?
Sola's intelligence layer is the engine that powers Lumina Signals.
It combines AI reasoning, graph analysis, and security domain expertise to process signals across all your connected data sources, map relationships between assets, and reason across your entire environment to surface high-confidence, prioritized signals.
Last updated
Was this helpful?