Pick an alert. The agent inspects attached files with a CNN, classifies network flows, looks up indicators, retrieves ATT&CK and playbook knowledge, then proposes a response. Nothing runs until a person approves it.
Every investigation is stored with its full evidence trail. Approvals and rejections are recorded against the analyst who made them.
| Case | Alert | Severity | Risk | Pending | By | When |
|---|
This is the retrieval layer the agent uses. Try a behaviour, a technique ID, or a symptom. Results come from MITRE ATT&CK techniques, OWASP categories and incident-response playbooks.
Retrieval runs in your browser with TF-IDF over the same corpus the backend indexes. In the full stack, swap it for embeddings and a vector database without changing the agent.
Each layer hands structured evidence to the next. The agent may read and reason, but it can only propose actions.
Both are small enough to train on a laptop CPU during the Docker build. They are trained on synthetic, harmless data so the repository ships no malware. Retrain on a real corpus for production use.
Each file becomes a 64x64 grayscale image. Code, text, padding and packed or encrypted regions look different, so a CNN can classify them and Grad-CAM can show where it looked.
Input 1x64x64
Conv3x3 16 + BN + ReLU + Pool
Conv3x3 32 + BN + ReLU + Pool
Conv3x3 64 + BN + ReLU + Pool
Conv3x3 128 + BN + ReLU (8x8 map for Grad-CAM)
GlobalAvgPool, Dropout 0.3, Linear 4
Classes: benign, packed_or_encrypted,
trojan_dropper, ransomware_like
A window of 16 packets with 5 channels (size, direction, inter-arrival time, TCP flag, destination port) is classified as normal traffic or a known attack pattern.
Input 5x16
Conv1d 32 + BN + ReLU
Conv1d 64 + BN + ReLU + Pool
Conv1d 64 + ReLU
GlobalAvgPool, Dropout 0.2, Linear 4
Classes: benign, syn_flood,
port_scan, brute_force
Fitted only on a benign baseline of activity windows. A window is flagged when it is rarer than 98% of that baseline, and the features that deviate most are reported as drivers.
Features: events_per_min, failed_ratio,
distinct_users, distinct_ips,
off_hours_ratio, mb_out
150 trees, benign baseline of 1000 windows
Output: anomaly probability, drivers,
credential_attack / data_exfiltration /
off_hours_activity