An on-prem AI SOC platform that sits above your SIEMs, not beside them. ARIA processes alerts already detected by Wazuh, Firewalla, Splunk, CrowdStrike and 7 more — its job is to correlate, validate, enrich, and triage them into higher-fidelity verdicts. Every byte of customer data stays on your hardware; all AI inference is local Ollama, with a second local model as failover. No cloud LLM. Ever.
ARIA sits above the SIEM layer. SIEMs detect events. ARIA decides what they mean.
Single-event pattern matching is the SIEM's job. ARIA's job is the cross-alert sequence: alert A + B + C within window W on same host = breach. Higher-fidelity than any single source can produce.
Is this normal-noise for this tenant or genuinely new? Per-tenant FP rates, UEBA baselines, asset criticality, deterministic rules library — all feed the verdict.
9-agent pipeline produces a verdict + evidence chain + recommended action. Explainable. Audit-logged. MITRE-mapped. Hard caps on tokens and iterations per agent.
3-minute 30-second captioned walkthrough of every module. Generated from a demo environment.
Eight slides — problem, position, pipeline, differentiation, what's shipped, audit posture, roadmap.
A double-sprint that landed Sigma-at-scale, vector similarity, the conversational hunt agent, and a full L3 SOC-analyst UI audit remediation. Production-ready.
max_iters=10, token_budget=50K; force-summarize on exhaustion.company_id injected, never LLM-supplied.nomic-embed-text via Ollama, on-prem) on every alert + investigation./api/{investigations,alerts}/{id}/similar.migrate_sigma_bulk_import.py --upgrade <tag>.ARIA_URLHAUS_POLL_SECONDS cadence (default 900s).s3.amazonaws.com capped at 5).ARIA_MFA_REQUIRED=true hard-enforce env./admin/llm.playbook_runs table with full execution history, viewer, and investigation linkage.aria-clickhouse live; ReplacingMergeTree alerts + investigations + materialized view.time_range > 24h queries to columnar (Sprint C2).Tenant resolution at the ingress door. Deterministic rules before the expensive pipeline. Canonical schema downstream so adapters add without touching downstream code.
Before the investigator runs, the enricher does a (tenant, MAC → hostname → IP) lookup against the tenant-scoped devices table. Match returns a device_profile rendered at the top of the LLM prompt. The LLM is told not to guess an OS or role contradicted by the block.
Analyst-authored auto_close / suppress rules fire before the canonical pipeline. Each rule has a natural key, priority, action, optional suppression window, immutable versioning with one-click rollback.
Queue naming aria.<concern>.<company_id>. The supervisor queries the tenant roster on startup and launches worker processes per tenant. Stage workers shared across tenants; per-tenant consumers isolate customer-level failure modes.
What the platform does, by concern. Every surface tenant-safe by default, every destructive action audit-logged.
Triage → Threat Intel → Knowledge (RAG + pgvector) → Forensics → Investigator (local LLM) → Remediation (policy-gated) → Validation → Audit → Notify. Plus the conversational Hunt agent. Typical end-to-end: 60-90s. Per-agent token + iteration budgets.
Tenancy is an ingress property, never a payload property. Every data source carries a unique ingest token; the ingress API resolves X-Aria-Source-Token to (company_id, data_source_id) at the door before the body is touched.
3,101 SigmaHQ community rules pre-loaded as global / disabled. Per-tenant opt-in without forking. Severity-banded (70 critical / 1,400 high / 1,334 medium / 272 low). 89% MITRE-mapped. GitHub provenance link + YAML expander on every row.
HuntWorkbench → AI Hunt tab. Plain-English questions → plan + 6 read-only tools + answer. Hard caps: 10 iterations / 50K tokens. SSE-streamed plan/thought/tool cards. Save-as-saved-search and save-as-rule one click.
768-dim embeddings on every alert + investigation, generated locally via nomic-embed-text. Cosine similarity via ivfflat indexes. Tenant-scoped /similar endpoint feeds RAG knowledge layer + hunt-agent similarity tool + investigator UI panel.
Live URLhaus polling (26K URLs / 32K IOCs). ThreatFox. IOC scorer with explainable components. Lifecycle states: active / stale / expired / suppressed / trusted. Cloud-CDN allowlist prevents s3.amazonaws.com-style FPs. Feed-health widget.
Per-tenant MTTD / MTTR vs targets — defaults critical 5m, high 30m, medium 2h, low 24h. Green / amber / red bands. 9-bucket SLA breach taxonomy with root-cause classification.
MFA enrollment wizard with QR + backup codes. RBAC matrix: role × resource × action with custom roles. API-key rotation with 24h dual-read. 5-strike lockout. Active session list with one-click revoke.
Circuit breaker: qwen3.5 → llama3.1:8b → degraded queue, all local Ollama. Cloud providers shown but disabled by on-prem policy. Per-agent token + iter caps. No customer data ever leaves the host.
Field-aware DSL (severity:critical AND source:wazuh), visual filter builder, schema panel, cursor-paginated infinite scroll, JSONB SQL pushdown. Saved searches private / tenant / global. Any saved search → scheduled alert.
Per-rule TP/FP/escalation rate, noisy-rule ranking, explainable tuning recommendations, replay against historical alerts, MITRE coverage with gap detection, candidate-rule review queue, immutable rule versioning with one-click rollback.
playbook_runs table with full execution history — actor, target, dry-run flag, result, duration. Linked to investigations. Foundation for verdict-triggered auto-execution (Sprint N+2).
AI-generated narratives. Scheduled email + Slack delivery with PII guard on Slack — only summary KPIs ever leave. PDF export with per-tenant white-label. QoQ / YoY period comparison with graceful fallback.
Per-tenant worker pool. Graceful pipeline degradation. Postgres + OS backups + logrotate. Prometheus /metrics. SHA-256 hash-chained custody per investigation. Audit log on every authn / authz / config / policy / rollback / IOC override / session revoke / remediation event.
Every component is on-prem. Nothing in the inference path requires internet.
Two independent audits this month. Every critical finding closed.
15 findings · 3 CRITICAL · 5 HIGH · 5 MEDIUM · 2 LOW
Status: 15 / 15 CLOSED
/metrics liveC+ "Do not deploy" → B- (reconciled) → A-
Status: A- · cleared for production
Correlation is the missing core. MSP polish closes the operating loops. Posture extends ARIA outward. Cold storage waits for customer ask.
5–6 days · the missing core
Multi-alert pattern detection: "alert A + B + C within window W on same host = breach".
5 days
5–6 weeks
Tenant declares external assets. 15-day light scan → letter grade A/B/C/D/F across 6 categories:
Mini-SecurityScorecard, on-prem.
Representative module captures from a demo environment. Click to enlarge.