BoundedSOC AI
Explainable, human-in-the-loop security-investigation automation. The AI assists with triage, enrichment and reporting, but it never decides on its own, and a human approves every claim before it is final.
The problem
SOC analysts repeat the same manual steps on every alert: triage, extracting indicators, threat-intel enrichment, correlating events, MITRE ATT&CK mapping, building a timeline and drafting the report. This project turns those repetitive steps into a guided, evidence-backed workflow, without ever letting a model make the actual security decision.
The core rule
- The AI never has network, shell or response-action access. No code path isolates a host, blocks an IP, deletes evidence or closes an incident automatically.
- Every AI claim must cite real evidence. A claim without evidence is dropped before it reaches the database, and the drop itself is logged.
- A human analyst approves, edits or rejects every AI claim before it is treated as final.
- Everything writes to an append-only audit log: who, what, when, why.
- All data is synthetic and every threat-intel provider is mocked by default; going live is opt-in, per provider.
How an alert is handled
Tech
Try it
The repository runs with Docker and needs no paid API keys: the default provider is an offline stand-in, so every feature works for free. The API, an interactive docs page, a dashboard and n8n all start together with one command.