SOC

SOC gathers the logs of the whole organization: those of Windows and Linux machines, through a small program installed with a single command, and those of your own applications, through an API or through a log type that you describe yourself, without writing any code. A single search goes through all of them, with a simple language ("host:web01 AND level>=warning"), per-minute charts and the list of the most frequent values.

Rules watch the stream: one event is enough, or too many failures from the same address, or a machine that has gone quiet. Twenty-four rules are included, each tied to a MITRE ATT&CK technique. An alert groups similar events instead of repeating itself; you take it on, annotate it, open it as a case, and email, a webhook, Slack or Teams notify the right person without drowning them.

The collector only reads: it opens no port, receives no order from the server and reads only what the machine's administrator has allowed it to read. It keeps its batches on disk when the network goes down and resends them afterwards, without duplicates. Your AI agents can query the logs and handle alerts through the MCP endpoint, without ever deleting anything. SOC searches and alerts: it is neither an antivirus nor an automatic response tool.

The vault (Vault module) keeps the organization's passwords, authentication codes (TOTP), SSH keys and certificates on the same site, in vaults shared by person. For servers, an SSH and RDP gateway opens the session in the browser without ever handing over the credential, records it (encrypted, announced from the first line, replayable only by the administrators) and lets it be observed live or cut. An Android app computes one-time codes without a network. The vault follows the SOC's license and rights.

SOC is in preparation. It will join the Prophetix subscription catalogue when it is released.