Jeremy Martinez
All work

Security & Response

The AI SOC

Everybody has detection. Nobody has anybody to read it. That is not a problem you hire your way out of, and it is not a problem you buy another product to fix.

Designed, built, and operateWazuhauditdFalco / eBPFPythonClaude agentsPrometheus
  • One question per case: is it real, and by what mechanism. Everything else is decided elsewhere.
  • The investigator holds no tools and gathers no evidence itself. It asks for evidence by number.
  • It can close a case. It can never raise a severity.

The problem

The fleet already had detection. Host intrusion detection, kernel audit, runtime visibility, access logs, all of it running, all of it producing. It had a response engine on the far end too. What it did not have was anybody in the middle deciding which of that mattered.

So before building anything I went and measured what was actually happening, which is the least enjoyable hour in this job and the only one that counts. The triage ledger built for exactly this purpose was all but empty. Almost nothing had ever been investigated, and the rest resolved to “page a human” within minutes with nothing behind the decision.

That is not a tooling gap, and buying another product would not have touched it. It is an alert stream nobody can answer, which is the honest condition of most security operations, including the ones with staff.

One question per case

This thing answers one question about an alert and flatly refuses the rest: is it real, and by what mechanism? Severity, response, containment all live somewhere else, behind a different gate, decided by something with different authority. One question is a job you can do well. Four is a job you do badly and then explain afterwards.

Every alert derives a stable signature, so recurrence becomes a query rather than a memory. “This is the third time this shape has appeared on this class of host this week” is computed on the trusted side and handed to the investigator as a fact.

A worked example: an alert becomes a case, or dies

One authentication alert, from arrival to verdict. The investigator never touches the host and never writes a command. The markers are stages, not a measured trace.

  1. arrivesA host intrusion rule fires on repeated authentication failures from a single source.
  2. signatureThe case derives a stable signature, so “third time this shape has appeared on this class of host this week” is computed on the trusted side and handed over as a fact rather than recalled by somebody.
  3. evidenceThe investigator asks for evidence by number out of a published catalogue. A deliberately stupid executor runs that probe with fixed arguments.
  4. referenceIt may say to use the output of probe two. It cannot emit a command, a path or a query. There is no string it can write that becomes an argument.
  5. verdictOne question answered: is this real, and by what mechanism. It can close the case. It can never raise the severity.
  6. handoffIf it is real, the response engine picks it up behind a different gate, with different authority and a human on the destructive end of the list.

The reading a staffed tier-one would have done is finished before anyone opens a laptop, and the only thing the model is allowed to influence is a verdict, never a machine.

  • The investigator runs with no tools

    It asks for evidence by number, out of a published catalogue. A deliberately stupid executor runs that probe with fixed arguments. Every parameter comes from somewhere trusted: a field on the case, or a value lifted out of an earlier probe into a table only the privileged side can read.

  • It may reference, never compose

    The model can say “use the output of probe 2.” It cannot emit a command, a path, or a query. There is no string it can write that becomes an argument.

  • A veto, never a trigger

    An investigation can close an incident. It can never raise a severity, add an option, or change a gate. The asymmetry is deliberate and matches the one the response quorum has, for the same reason.

Detection content is code

Rules, decoders and runtime policies are versioned and deployed from a repository, never hand-edited on a box. Agent-written rule proposals land in a proposals directory and are deployed by a human. The plane that suggests detection content is not the plane that ships it.

The whole tree is read-only by construction: no script in it changes state on any host. That is what makes it defensible to run against machines holding third-party data.

Engineering decisions

The calls I made, and what each one cost.

The model never gathers its own evidence and never emits a target.

An attacker who can write a log line must never be able to make that line the thing the system acts on. Every other control is a filter on that channel; this one removes the channel.

Pin the agent's permissions to the project, not the machine.

Leave the settings source unstated and the run quietly inherits the operator's own configuration, which carries broad write and edit permissions and re-syncs from an external repository every ten minutes. An investigator with write access is not an investigator. It is a second attacker holding better credentials than the first one.

Never believe a vendor flag that claims the tools are off. Go measure it.

The documented way to run an agent with no tools quietly resets it to a default set instead, and that default still hands it a shell, a file writer and a fetcher. The predecessor responder had run under that flag repeatedly without ever misbehaving, which proves only that the model was complying. Compliance is not a control. The policy is now enforced by a hook that denies two independent ways and logs every call including the allowed ones, because silence is exactly what a broken control looks like.

Assert the property, not the proxy.

A brute-force guard passed its “is the service running” check for weeks while its firewall chain sat orphaned and every ban it issued did precisely nothing. The process was up. The dashboard was green. The bans were theatre. Checks now assert that the thing works, not that a process exists.

A check that cannot fail is worse than no check.

It occupies the slot a real one would take, and it reports green forever. Several checks here were built by deliberately breaking the system first and confirming the check fired.

More systems

Reliability & Automation

The Fleet Control Plane

One person cannot watch a production fleet around the clock. So the machine takes the first action, and the interesting part is everything that stops it.

Security & Response

Autonomous Response

The AI never writes a command. It picks a number off a list, so the worst a hostile input can do is make it pick a different approved action.

Security & Response

NDR Rollout

The value was never inbound attack detection. It was being able to prove whether data left.

I'm looking for Incident Commander and SRE roles.

If your team is drowning in toil, alert noise, or incidents that never quite close. That is the work I do.

Get in touch