D3 Security (Morpheus)

There are 800+ self-healing integrations across SIEM, EDR, IAM, cloud, email, NDR and DLP, with response actions run through playbooks and integration commands that sign in to outside systems and act there. Named connections include Microsoft, CrowdStrike, SentinelOne, Splunk, LogRhythm, Elastic, Fortinet, Okta, Zscaler and Recorded Future. When a connector drifts it repairs itself, with an 18 minute mean time to recover that D3 sets against weeks for manual fixes, and a command details panel shows each integration's commands and sample data.

SourceD3 Security, d3security.com/morpheus and docs.d3security.com Morpheus releasesread 2026-10-05

Response playbooks are generated at runtime for each incident, and adaptive playbooks are built from the chat interface with Approval blocks. Customers also build their own playbooks in the platform's SOAR engine, set to start when a case escalates or when data is ingested. Adaptive playbooks combine Morpheus Agent, Router, Parallel, Send Email and Approval blocks, and an investigation playbook can be run from the incident chat. An Agentic Task capability puts bounded LLM reasoning inside a playbook step, and legacy SOAR playbooks keep working during a migration.

SourceD3 Security, docs.d3security.com Morpheus releases and d3security.com/morpheusread 2026-10-05

The Cybersecurity Triage Reasoning Graph encodes senior analyst reasoning built by D3's specialists. It holds D3's own security knowledge, not a map of the customer's systems.

Attack Path Discovery assembles evidence across the customer's EDR, identity, email, cloud and network sources for each alert, and D3 publishes no way for a customer to load its own material for Morpheus to search. D3 says the graph took 24 months and 60 specialists to build.

Linked incident search finds related cases by severity, status, type, owner, tags, tactic, technique or creation date, and global lists can be edited in bulk as JSON.

SourceD3 Security, d3security.com/morpheus and docs.d3security.com Morpheus releasesread 2026-10-05

There are four autonomy modes (Deterministic, AI-Assisted, AI-Led, Autonomous), command-risk tagging sets the approval gate for response actions, and adaptive playbooks start from a plan for analyst approval with an Approval block type, so approval comes before the action commits. In AI-Assisted mode an analyst approves every action, in AI-Led mode the analyst oversees command risk tiers, and Autonomous mode keeps approval gates that can be set per workflow, per tenant or per regulator. Attack Path Discovery is read only and takes no action on its own.

SourceD3 Security, d3security.com/morpheusread 2026-10-05

D3 Security is SOC 2 Type II certified, and the platform has access controls with roles and groups carrying permissions, sites for business-unit separation and multi-tenancy. D3 is a member of the Microsoft Intelligent Security Association, and the platform aligns with MITRE ATT&CK and D3FEND. Named user licenses come with every subscription, and multi tenant deployments keep each client's data, configuration and views apart.

SourceD3 Security, docs.d3security.com user docs and d3security.com/resources/faqread 2026-10-05

Each incident has one unified audit trail of every action, decision and task across all six capabilities, with a complete evidence chain for every investigation, so each investigation keeps its own run record. The trail uses the same format across every capability and autonomy mode, and every element of an attack path comes from a real tool query that is timestamped and attributed. D3 positions the trail for review under SEC, NYDFS, HIPAA, NERC CIP, NIS2, DORA and the EU AI Act, and a utility command retrieves attack path results with their AI summaries.

SourceD3 Security, d3security.com/morpheus and docs.d3security.com Morpheus releasesread 2026-10-05

Since release 18.4, Morpheus reviews how an incident was handled and converts the workflow into a reusable SOP skill, a stored artifact carried forward. D3 does not say who can use an SOP skill or how long one is kept. Case files hold the record of each incident. Analysts or Morpheus itself can then run an SOP skill on later incidents that look alike.

SourceD3 Security, docs.d3security.com Morpheus releasesread 2026-10-05

The platform is hosted on Microsoft Azure across named geographies (US, Canada, EU, UK, APAC, Gulf, Nordics) with data residency configurations, and cloud, on-premise, hybrid and air-gapped deployments are supported. Azure regions include the United States, Canada, Ireland for the EU and Japan, and the residency configurations address GDPR, EU data sovereignty and regional government mandates. MSSPs get a native multi tenant architecture with isolated client data, per tenant configuration and segregated client views.

SourceD3 Security, d3security.com/resources/faq and /morpheusread 2026-10-05

Morpheus ships one reasoning engine with six named capabilities and generates playbooks at runtime, and SOP skills are derived from the customer's own incidents. There is no catalog of named prebuilt agents or templates. The six capabilities are triage, investigation, response and orchestration, self healing integrations, agentic tasks and autonomy modes, all in one subscription priced as a fixed annual fee by daily alert volume, from 500 to 10,000 alerts a day with custom tiers above, plus named user licenses.

SourceD3 Security, d3security.com/morpheus and /resources/faqread 2026-10-05

The moment an alert lands, the investigation engine assembles the attack-path story, and playbooks run on ingestion or escalation, so work starts with no one asking. Every alert is triaged, so none is closed silently, and analysts can also launch an investigation playbook from the incident chat.

SourceD3 Security, d3security.com/morpheus and docs.d3security.com Morpheus releasesread 2026-10-05

Morpheus also supports customer-preferred LLMs for organizations that require it, without changing the pricing structure, so a customer can bring its own model, and the default models are not named. The Agentic Task capability is provider agnostic and runs through D3's built in connector or the customer's existing AI vendor contract. D3 absorbs all token and inference costs within the subscription, and the Triage Reasoning Graph is included at no extra cost.

SourceD3 Security, d3security.com/resources/faq and /morpheusread 2026-10-05

The D3 Command API (API key or JWT auth, POST endpoints for Incidents, Events, Playbooks, Artifacts, Files, Users, Sites and GlobalLists) comes with utility command docs, and there is no MCP server. Release 18.4 lets teams organize custom utility commands in nested folders and filter command search by connection, and it added a command that returns attack path results.

SourceD3 Security, docs.d3security.com API docs and Morpheus releasesread 2026-10-05

D3 tests Morpheus against simulated attacks and adversarial inputs as part of its own release work and publishes revelation and closure rates. Customers get no published way to test Morpheus on their own deployment. D3's own figure is that up to 95 percent of alerts are triaged and investigated to L2 depth in under two minutes.

SourceD3 Security, d3security.com/morpheusread 2026-10-05

There is no browser or computer use by Morpheus, which acts through integrations and commands. Attack Path Discovery queries the connected tools through their APIs and stays read only.

SourceD3 Security, d3security.com/morpheusread 2026-10-05