SOC AI
AI-assisted SIEM + SOAR
A self-hosted security operations center: collect logs, check addresses against AbuseIPDB and AlienVault OTX, map detections to MITRE ATT&CK and respond automatically — with AI triage that uses your own keys.
- Docker
- Windows
- Linux
- x86-64
- ARM64
Why SOC AI
Correlate everything
Turn raw logs from many sources into ranked, actionable incidents.
AI triage (BYOK)
Summarize and prioritize incidents automatically using your own keys.
MITRE ATT&CK mapping
See exactly which tactics and techniques you are seeing in the wild.
Automated response (SOAR)
Block, isolate and alert with custom playbooks — no manual toil.
You own the whole stack
- BYOKBring Your Own Key
AI-assisted triage runs on your own provider key.
- BYOMBring Your Own Model
Swap in a local model for classification if you prefer.
- BYODBring Your Own Data
All logs, incidents and evidence stay in your environment.
- BYOIBring Your Own Infrastructure
Deploy the core and workers as containers on your own hardware.
- BYOXBring Your Own eXecution
A complete SOC you operate and own — no data shipped to a vendor.
Capabilities
- ✓SIEM log collection across many sources
- ✓Threat-intel lookups (AbuseIPDB, AlienVault OTX on your keys) plus a local feed
- ✓MITRE ATT&CK detection mapping
- ✓SOAR automation and custom playbooks
- ✓Incident management and tracking
- ✓Executive reporting
Own SOC AI for life
One lifetime licence. Runs on your own servers — cloud, on-premise or air-gapped. Your keys, your data.