are never investigated
Another 46% turn out to be false positives — the team’s time goes to noise, not attacks.
Microsoft / Omdia, 17 February 2026AI-SOC · attack detection in event logs
Not another alert — a ready-made investigation of the attack.
AI-SOC finds attacks in event logs with a language model — no manual correlation rules — and builds the investigation right away: the attacker’s chain of actions mapped to MITRE ATT&CK, plus the events behind every conclusion. It runs inside your perimeter on a local model.
● local model on CPU
● on-prem and air-gapped
● SIEM alerts → verdict
attack chain · MITRE ATT&CKinvestigation
TA0001initial access
TA0002execution
TA0006credentials
TA0008lateral movement
TA0010exfiltration
ws-buh-14 · powershell -enc from winword.exeT1059.001
ws-buh-14 · lsass.exe memory accessT1003.001
svc-backup → srv-fin-02 · SMB logonT1021.002
PAN-OS · upload to an external addressT1048
✓ every conclusion is backed by eventsmodel: local
19verified source packs — out of 82 shipped
11MITRE ATT&CK tactics in the investigation’s attack chain
316ready-made threat hunting questions
0manual correlation rules — the model drives detection
Interface
This is AI-SOC at work
Alert queue and investigation: the attack chain mapped to MITRE ATT&CK and the events behind every conclusion of the model.
Demo data.
Why now
SOCs are drowning in alerts. Meanwhile, attackers operate for months.
Correlation rules are written and maintained by hand, and the queue is worked one signal at a time. A large share of alerts never gets looked at, even though the traces of the attack sit in the logs the whole time. You need a tool that finds the attack on its own and hands the analyst the full picture.
from intrusion to encryption
All that time, the attacker is operating inside the network. Damage ranges from RUB 50 million to RUB 1.5 billion.
Positive Technologies, CNews, 14 October 2026cancelled by Aeroflot after a cyberattack
More than 80 others were delayed. The hackers claimed they had been inside the network for about a year.
Interfax, 28 July 2025How it works
Logs → baseline → model analysis → investigation.
01
Collection
The Vector collector ingests syslog over UDP and TCP, files and HTTP, and source packs normalise events to a single OCSF 1.3 schema.
02
Baseline
From 30 days of history, AI-SOC builds a baseline of normal activity — events are assessed against what is normal for your infrastructure specifically.
03
Analysis
The model analyses event windows in two passes: a first pass (L1) and a deep pass (L2). Any claim not backed by specific events is discarded.
04
Investigation
The alert arrives with the attacker’s chain of actions across MITRE ATT&CK tactics, an entity graph and the supporting events. The decision stays with the analyst.
Capabilities
Instead of a stream of signals — investigations you can actually work with.
Attacks without manual correlation rules
The model finds attacks, so there is no rule base to write and maintain for every scenario. A conclusion not backed by specific events is discarded — before it reaches the queue.
An attack chain instead of scattered alerts
The attacker’s steps across 11 MITRE ATT&CK tactics, an entity graph and the supporting events — in a single investigation. ATT&CK Enterprise v19.1 catalogue: 15 tactics, 697 techniques.
Alert decisions — with a rationale
Confirm, dismiss, escalate or assign: every decision is saved to the history along with its rationale. Duplicates are merged, and risk accumulates per entity.
316 ready-made threat hunting questions
Test hypotheses against your own logs without writing queries from scratch. Log search and rule export to Sigma format.
19 verified sources out of the box
Windows Security, Sysmon and PowerShell, Linux auditd and sshd, web servers, PostgreSQL, Kubernetes, Cisco, FortiGate, PAN-OS, Suricata and Zeek. Another 63 experimental packs ship with the product.
Logs into an investigation — as a file
An export from a host that isn’t connected to collection can be uploaded straight into an investigation: 14 parsers and EVTX.
Next to your SIEM, not instead of it
AI-SOC accepts SIEM alerts and returns a verdict on each one via webhook. Outgoing webhooks, storage in your own ClickHouse, platform health in Alertmanager.
A local model, no GPU required
The base package is llama.cpp on CPU inside your perimeter, including air-gapped ones. An external model is connected only if you choose to.
Roles, settings log and reports
5 roles — from viewer to administrator, a settings log and decision history. Investigation and hunting reports in PDF and HTML.
Who it’s for
The analyst gets an investigation. The SOC lead gets a manageable queue. The CISO gets control without logs leaving the perimeter.
SOC lead
A queue without duplicates, assignment and escalation with a rationale, decision history. No correlation rule base to maintain — the model drives detection.
L1/L2 analysts
The alert arrives with the attack chain, entity graph and supporting events already in place. Log search, file uploads into investigations, 316 hunting questions and Sigma export.
CISO
Attack detection on a local model — logs never leave the perimeter. An auditor role, investigation reports in PDF and HTML, and a pilot alongside your existing SIEM.
Deployment
An offline package inside your perimeter. No GPU required.
- Delivery
- Offline package
aisoc-<version>-linux-{amd64,arm64}.tarandinstall.sh; Docker Compose. In the current version, detection is performed by the model only - Environment
- On-prem, including air-gapped environments with no internet access
- Model
- Base package — local llama.cpp on CPU; model weights are not included in the distribution. An external model — only at the customer’s decision
- CPU pilot profile
- Gemma-4-26B-A4B Q4 and Qwen3.6-35B-A3B Q4 on a server with 512 GB of RAM; no GPU required
- Minimum with an external model
- 8 vCPU and 16 GB — up to 500,000 events per day
- Collection
- Vector collector (VRL): syslog UDP/TCP, files, HTTP, JSON over HTTP; normalisation to OCSF 1.3
- Sources
- 82 packs shipped. Fully verified: 19 — Windows Security, Sysmon, PowerShell, Linux auditd, syslog, sudo, PAM, sshd, Nginx, Apache, IIS, PostgreSQL, Kubernetes audit, Cisco ASA, Cisco IOS, FortiGate, Palo Alto PAN-OS, Suricata, Zeek. The other 63 are experimental
- File upload
- Into an investigation: 14 parsers and EVTX
- Integrations
- SIEM alert ingestion (
/api/ingest/alerts) with verdicts returned via webhook; outgoing webhooks; the customer’s ClickHouse; Alertmanager for platform health - Roles and audit
- 5 roles: viewer, auditor, analyst, manager, administrator. Settings log, decision history, reports in PDF and HTML
- Default retention
- Events — 45 days, stream — 180, findings — 90, alerts and investigations — 365 days
30-day pilot
Decide to buy based on a pilot report on your own logs — not a demo.
We agree the success criteria before we start. The pilot runs alongside your existing SIEM: AI-SOC can accept its alerts and return verdicts. All you provide is a server inside your perimeter and access to the logs.
STEP 01
Scope
We choose log sources and scenarios together with your SOC and IT teams.
STEP 02
Installation
We deploy inside your perimeter from the offline package — in one day.
STEP 03 · 30 DAYS
Pilot
We work on your logs in observation mode, in parallel with your current monitoring.
STEP 04
Decision
A report on what the model found and which alerts your analysts confirmed — and a decision on production rollout.
Model weights are not included in the distribution — we agree the model and server profile before the pilot starts.
FAQ
What SOC and security teams usually ask
Does AI-SOC replace our SIEM?
No, it works alongside it. AI-SOC accepts alerts from your SIEM and returns verdicts on them via webhook, and also collects logs with its own collector. The pilot runs in parallel with your existing monitoring.
Do logs leave the perimeter?
No, unless you decide otherwise. The base package is a local model on CPU inside your perimeter; air-gapped environments are supported. An external model can be connected only if you decide so — in that case, data is sent to it without masking.
Do we need a GPU?
No. The pilot profile is the Gemma-4-26B-A4B and Qwen3.6-35B-A3B models with Q4 quantisation on a CPU server with 512 GB of RAM. Model weights are not included in the distribution — we agree the model with you before the start.
How many events can it handle?
In the minimum configuration with an external model — 8 vCPU and 16 GB — up to 500,000 events per day. For a local model, we size the hardware during the pilot to match your log volume.
Does it work in real time?
No, and we don’t promise that: analysing an event window takes minutes. What you get, though, is not a single signal but an investigation with the attack chain and supporting events. There is no automated response — the analyst makes the call on each alert.
How do you keep the model from inventing attacks?
Every claim the model makes must be backed by specific events from the logs — otherwise it is discarded. The analyst sees those events in the investigation and decides. We measure detection quality on your data during the pilot instead of promising it in words.
Do you have detection quality benchmarks?
We run control tests, but figures from someone else’s data and a different model won’t tell you much. We measure recall and the false-positive rate during the pilot on your logs with your model — and include them in the report.
Is there automated response and Jira integration?
No: there is no SOAR, and the analyst makes the decision. Events are sent via outgoing webhooks; there are no ready-made connectors for Jira or ServiceNow yet.
AI-SOC pilot
We’ll prove it on your logs, not on a demo stand.
Leave a request — we’ll agree the log sources, scenarios and success criteria for the pilot.
Request sent
We’ll contact you at the email you provided to arrange the AI-SOC pilot.
Other OpenZTA platforms
Corporate AIENCLAVEAnswers from documents, with a source link and within access rights
AI securityPromtWallInjections, personal data and agents under control
DataOpenDSPMWhere personal data lives and who can access it
CodeOpenASOCEvery code check in one pipeline
AccessZero TrustAccess only from a healthy device