Leon
An AI-powered investigation agent that performs structured first-pass investigation the moment an alert fires.
Picari insights
Mid-market to enterprise Security Operations Centers (SOCs) experiencing alert fatigue and looking to automate first-pass triage and deep contextual investigations.
- Automating Tier-1 alert investigations
- Correlating complex multi-stage attack paths
- Surfacing detection drift and blind spots
- Organizations without an existing SIEM/EDR or detection pipeline
- Teams requiring strict, manual determinism for every step of an investigation
- Very small IT teams with low alert volumes
Ask about pricing, alternatives, or if Leon is right for you.
- Personalized fit analysis
- See relevant alternatives
- Run an evaluation when you're ready
Core capabilities
Common use cases
Incident response prioritization
Multi-stage attack correlation
Privilege escalation detection
SOC alert triage and investigation
Things to consider
Every product has trade-offs, and which of them matter depends on your environment, your team and your timeline.
Booli Leon pricing and integrations
For Booli Leon integration and pricing details, ask Picari. Start a briefing with your question, such as whether it connects to your SIEM, identity provider and ticketing stack, or how it is priced at your seat count and data volume.
Unverified profile
This profile hasn't been verified by Booli yet. Information may be incomplete.
Are you from Booli? Verify this profileProfile last updated on 9 October 2026 by Picari.