Projects in AI-SOC, SOAR, and agent security.

A security layer for monitoring and controlling AI-agent tool usage across MCP servers — policy gates, call inspection, scope enforcement, and a tamper-evident audit trail.

Security focusPrevents unsafe or over-permissioned MCP tool invocations from reaching the network boundary.

A lab for testing AI-driven alert triage, IOC enrichment, and response workflows — synthetic telemetry, scoped tools, and a replay harness for tuning.

Security focusMeasures triage accuracy and false-positive containment risk per agent revision.

Detection controls for prompt injection, tool misuse, and data-exfiltration attempts — a rule + classifier hybrid with measured efficacy per layer.

Security focusLayered defenses across input, tool arguments, and outputs — never relying on a single check.

Reusable playbook patterns for phishing, malware alerts, EDR isolation, SIEM enrichment, and incident escalation — opinionated, tested, and tenant-portable.

Security focusStandardizes consequential SOC steps so they are reviewable across XSOAR, Tines, Sentinel, and QRadar.

An agent that calls scoped enrichment tools across VirusTotal, Shodan, AbuseIPDB and internal CTI, reconciles results, normalizes confidence, and writes a single artifact per case.

Security focusRemoves drift in enrichment quality and gives downstream playbooks a stable schema.

A guardrail proxy in front of MCP and HTTP tool surfaces — per-tool policy, argument validation, redaction, and a tamper-evident audit log per session.

Security focusCuts scope-violating calls to zero in red-team eval and makes every call replayable.