Security Ops
AI-Powered SOC & Autonomous Incident Response Platform
Unauthorized actions 0
Ingest, correlate, investigate with RAG/TI, HITL approvals, and verify-before-success remediation.
M0–M10 complete · API 1.0.0 · Closeout 2026-09-12
The problem
SOC teams drown in alert noise, weak correlation, and ungated remediations.
Alert noise
SIEM/EDR/IdP/email floods; analyst fatigue.
Weak correlation
Related events stay fragmented tickets.
Invented findings
Ungrounded LLM answers without citations.
Ungated remediation
Isolate/revoke/block without HITL or verify.
Unsafe analytics
Free SQL against production security data.
The solution
FastAPI owns investigation, HITL, SQL guard, and remediation verify; n8n owns thin ingest/notify wrappers.
An AI SOC that investigates and acts safely: correlated incidents, grounded recommendations, gated remediations — not a chatbot on logs.
Normalize + correlate
Events into Postgres incidents with shared context.
Investigation + RAG/TI
Multi-agent pivots with grounded citations.
HITL approvals
Remediation requires structured approval.
Verify-before-success
No silent 'done' without verification gates.
Text-to-SQL guard
Read-only analytics allowlist.
SIEM/EDR/IdP/email → n8n ingest → Postgres incidents → FastAPI triage/RAG/HITL/remediate → verify → dashboard/notify
Before → After
Architecture
Delivery
Milestone narrative from kickoff through closeout — all gates met.
| ID | Theme | Unlocked |
|---|---|---|
| M0–M1 | Architecture + skeleton | Compose stack, schema, FastAPI, n8n, health |
| M2–M3 | Core intelligence | Orchestrator/agents, RAG, primary integrations |
| M4–M5 | Reliability + HITL | Approvals, DLQ, audit, Phase 1 gate |
| M6–M7 | Depth + Phase 2 | Secondary channels/agents, Phase 2 regression |
| M8–M9 | Dashboard + scale | Ops UI RBAC, eval, observability, adapters |
| M10 | Closeout | Docs, UAT/smoke, KT pack, deliverables |
Proof
Verified on local Docker dry-run — no invented client metrics.
m10 smoke
ALL_PASS
Closeout scenarios
Unauthorized actions
0
Agent AuthZ enforced
Destructive SQL
0
Analytics guard
API
1.0.0
AIPSOC release
Stack
- FastAPI
- n8n
- Postgres
- Redis
- Qdrant
- SIEM/EDR connectors
- Caddy
Want a system like this?
We build production AI ops platforms — multi-agent orchestration, RAG, CRM, and reliable automation — not one-off chatbot demos.