How NexSOC is built.

Rules choose the response, not the model

Containment proposals come from fixed rules over the risk score, the investigation's threat likelihood and threat-intel verdicts. The model explains and summarises; it cannot pick an action.

Approvals are single use

An approval names one action and one exact target. It is consumed before the action runs, so a retry or a different target needs a fresh human decision.

Real tools always beat simulations

When a real EDR is connected, an approved action can never fall back to the simulator. A failure is shown as a failure, never as a success that did nothing.

Ambiguity stops the action

If two active devices share a name, NexSOC refuses to isolate either and asks an analyst. Isolating the wrong machine is worse than waiting a minute.

Secrets are references, never values

Connectors store only the name of an environment variable. Each customer can reference only its own variables, and platform credentials are off limits.

Missing evidence is not innocence

Every tool call records whether it found evidence, found nothing, failed or was denied. An unavailable tool is never reported as a clean result.

STACK

Boring technology, on purpose.

Small, well-understood parts that a customer's security team can review, and that run the same on a laptop as in the cloud.