What stays with you
- Raw logs and telemetry
- Your SIEM and its rules
- The AI agents that read your alerts
- Response actions in your tools
Platform
Built so your security data stays with you.
SOCGenX agents run inside your environment, next to the SIEM you already have. Our platform is the control plane: it sees detection metadata and verdicts, not your raw logs.
Architecture
What stays with you, what we see.
The data boundary is drawn around your environment. Only verdicts and evidence references cross it.
What we see
- Detection metadata, such as rule names and status
- Verdicts the agents reach
- Evidence references, not the evidence itself
- Health signals for each agreed log source
Proof Loop
Every detection path, checked end to end.
A green dashboard does not prove a rule works. The Proof Loop follows each path from the log source to an analyst decision and records every step.
Log source.
The agreed source keeps sending healthy data.
Detection rule.
The rule is enabled and reads that data.
Alert.
The rule raises an alert when the behaviour appears.
Analyst approval.
A person reviews the verdict and approves the outcome.
Evidence Ledger
A record your auditors can replay.
Each agent step, tool call and human approval is written to the ledger, so any verdict can be traced back to what was seen and who decided.
Append-only
Entries are added, never edited in place.
Hash-chained
Each entry is linked to the one before it, so a change to a past entry is detectable.
Replayable
An investigation can be walked through step by step after the fact.
Illustrative entries, not from a customer environment.
- event
- alert.received
- actor
- Triage agent
- detail
- Suspicious sign-in alert read from your SIEM
- chain
- linked to previous entry
- event
- case.summary
- actor
- Investigation agent
- detail
- Related sign-ins grouped, context gathered from identity logs
- chain
- linked to previous entry
- event
- action.recommended
- actor
- Response agent
- detail
- Disable the session token; waiting for approval
- chain
- linked to previous entry
- event
- action.approved
- actor
- Analyst
- detail
- Approved in Slack with a note
- chain
- linked to previous entry
Deployment
Run it where your data already lives.
Each deployment is scoped with you. The agents and the data boundary work the same way in every option.
On-prem
Agents run on servers in your own data centre, next to your SIEM.
Your cloud
Agents run in your cloud account, under your network and access policies.
Air-gapped
Designed for isolated networks, with updates delivered through a channel you control.
Guardrails
AI guardrails
The agents work inside limits your team sets, and every limit is visible in the ledger.
Recommend first
By default agents read and recommend. They do not change anything in your environment.
Approval before action
A response action runs only after an analyst approves it, or when it belongs to a low-risk class your team pre-authorised.
Evidence threshold
An agent must show the evidence behind a verdict before it can recommend an action.
Kill switch
Your team can pause every agent at once and drop them back to read-only.
Full audit trail
Prompts, tool calls, decisions and approvals are recorded in the Evidence Ledger.
See the architecture on your own stack.
We walk your team through the data boundary, the Proof Loop and the ledger using your SIEM.