Alerts are fragments. Investigations need a narrative.
Security logs rarely explain an incident on their own. A brute-force pattern, a successful login, endpoint probing, and an injection attempt may arrive as separate events even when they belong to the same campaign.
SecOps AI was built to move beyond isolated alert presentation. It parses events, creates detections, correlates related behavior, applies a canonical risk view, and gives analysts a persistent case and timeline for investigation.
AI adds context and next-step guidance; the platform does not position automated interpretation as a replacement for professional judgment.
From raw events to an investigation record.
Investigation pipeline
Connecting activity into an attacker story.
Detection coverage
Surfaces brute force, 404 scanning, multi-endpoint probing, path traversal, SQL injection, command injection, and suspicious user agents.
Compromise correlation
Connects failed-login sequences to later success and groups related activity into attack campaigns.
Persistent investigations
Supports cases, multi-session investigation history, suspicious-activity timelines, SOC-style search, and case sharing.
Operational output
Adds AI explanation and next steps, executive views, alerts, configurable detection rules, and PDF reporting.
A workspace for different investigation modes.
The frontend separates overview, investigation, live monitoring, case management, executive reporting, rules, and settings so analysts can move between immediate signal review and deeper, persistent work without losing context.
- Authentication and API keys support multi-user access patterns.
- Uploaded Apache/Nginx-style logs and real-time WebSocket ingestion share a common investigation model.
- GeoIP enrichment adds useful location context without replacing primary event evidence.
- Alerting and rule configuration keep detection behavior visible and adjustable.
Built for persistent security operations.
Backend
FastAPI · Authentication · API keys · WebSockets
Frontend
Next.js · Analyst workflows · Live monitor · Executive views
Persistence
PostgreSQL · Cases · Sessions · Investigation history
Analysis
Parsing · Detection rules · Campaign correlation · GeoIP · AI context