✳ SECURITY OPERATIONS LOCAL DEMO

Evidence Room.

A static BYOS SIEM + SOAR roadmap: streaming detections, deterministic narratives, independent delivery, and human control. Optional AI is advisory only.

◆ SYNTHETIC DATA NO LIVE CONNECTION

Candidate alerts⌁

02 recorded

SYNTHETIC TEST1 per isolated arm

Positive profile↗

8/ arm

✓Denied logins · 10s window

Negative control⌖

0 alerts

✓2 denied logins / arm

Action policy⛨

alert_only

▣No response action allowed

SYNTHETIC WALKTHROUGH · TWO INDEPENDENT EXHIBITS

IAM key change · network activity review

NOT INGESTED · NOT JOINED

RECORDED LOCAL CANDIDATE RUN

System One candidate evaluation

NOT PRODUCT-CONFIGURED

Inspect typed model output and provenance

STATIC ALERT PREVIEW · NOT EMITTED

CASE-NOTE PREVIEW · NOT PERSISTED

LOCAL DISPLAY ONLY · NO EXECUTION

Future model and agent configuration

One local synthetic candidate result is recorded above. These draft controls do not configure or run the product model or query evidence.

PRODUCT RUNTIME NOT CONFIGURED

Decision-model profileThe recorded local run is not the product default and cannot be rerun here.

Agent-triage review scopeQuestion scope only; no evidence query or correlation occurs.

Hypothetical read-only query ceilingNo query tools are configured.

Candidate model: RECORDED LOCAL CANDIDATE RUN · NOT PRODUCT-CONFIGURED

Agent triage: NO LIVE AGENT OR TOOLS

HUMAN-CONTROLLED RESPONSE

Response preview · disabled

END-TO-END SIEM / SOAR ROADMAP

Evidence pipeline

Capability map, not serial execution: ClickHouse analytics, Arroyo streaming, and Iceberg history are independent selected first-generation lanes. Optional AI branches never gate deterministic narratives or delivery.

STATIC SNAPSHOT · NOT LIVE

Historical syntheticFixture / expectedSelected roadmap / estimatedUnavailable / historical-not-approved

01 / INVESTIGATION

Keyed narratives

2 synthetic cases

iThese are fixture-backed test narratives, not live incidents. Click a case to inspect source references and rule logic.

02 / DETERMINISTIC LOGIC

Detection & test performance

CONTRACT + RECORDED RUN

⌁

Denied sign-in burstauth-denied-burst-v1

ALERT ONLY

auth.login.denied→≥ 5 events→10s event-time→candidate / arm

Independent group key: arm

03 / PROVENANCE

Sources & acquisition state

NO SOURCE CONNECTED

Availability, ingestion lag and source-side error rates are unavailable because this snapshot is not connected to any source.

RECORDED OUTCOME

Alert candidates

Two arm-scoped candidates from a historical bounded synthetic run using the retired custom store. No live alerting or replacement-system qualification.

⛨

Human control stays in charge

Disposition is candidate / low confidence. Automated response is disabled by alert_only.

OPTIONAL ADVISORY BRANCHES

System One & investigation

✳

Live analysis agentNo agent connected

UNAVAILABLE

Demo rationaleStatic, fixture-derived view

NOT RUNNING

One local synthetic candidate result is recorded above; no model runs on this page and no product model runtime or live agent is configured. No hidden chain-of-thought is stored or shown. System One and richer read-only investigation remain optional; deterministic delivery does not depend on AI, and model output cannot suppress required alerts or authorize actions.

INFRASTRUCTURE

Cost visibility

＄

Cited estimates are demo-runtime references—not observed bills or Log Salad pipeline costs. Azure's historical estimate is stale and not approved for reuse. Documented Azure read-back shows stopped ACI with public IP configuration retained but no assigned IP; do not restart. No live inventory or bill data is available.

✳ READ THE LABELS

Historical · synthetic · bounded retired-runtime test only

Fixture / expected · versioned contract

Selected roadmap / estimated · not implemented / not a bill

Unavailable / planned · no live evidence

＋ NEXT STEP NO-OP PREVIEW

Explore source onboarding.

Walk through a future setup review—locally, with no accounts or external effects.

PREVIEW ONLY · NEVER CONNECTS

ⓘ Preview only. This page has no cloud API, credential, or deploy capability.