AISOC by Quantinel Security operations platform
AISOC investigates each SIEM/SOAR alert, collects the evidence and returns a reasoned verdict and report in which every finding points to its source record. Response steps arrive with their blast radius assessed — and wait for an authorized person to approve them.
Operating principle AI-led investigation. Human-controlled response.
Animated illustration: a synthetic alert for host WS-DEMO-014 is normalized, enriched with asset, user and threat-intelligence context, linked to four evidence records, mapped to ATT&CK techniques, and turned into an isolation proposal that stops at “Awaiting human approval”. No action is taken.
00What AISOC covers
01Illustrative investigation
A synthetic case, step by step: what AISOC looks at, what it concludes, which record supports each conclusion — and where it stops so that a person decides.
Illustrative scenario · synthetic data Conceptual product preview — not a screenshot of the product interface
All steps and case views are shown below. With JavaScript enabled, the case plays step by step.
The SIEM alert is converted into the common schema. Host, user, process, rule and time become structured fields.
Rule-based checks run before any model call. No allowlist match and no known benign pattern, so the alert goes to investigation.
Asset, user and threat-intelligence context is gathered in parallel. Internal addresses are never sent to external sources.
Two hypotheses are formed. Read-only queries collect evidence for and against each, and the timeline is rebuilt from the records.
Each finding cites its evidence. ATT&CK mappings are checked against a fixed catalog, and a quality review runs before anything reaches the customer.
Isolation is proposed with blast radius, privilege and reversibility assessed. It now waits for an authorized person. Nothing has been executed.
| Ref | Source | Record | Why it matters |
|---|---|---|---|
| A0 | SIEM · rule match | Suspicious PowerShell execution · WS-DEMO-014 · demo.user | Trigger. Normalized into the common schema. |
| C1 | Asset inventory | WS-DEMO-014 · finance workstation · criticality: medium | Sets the impact of any response. |
| C2 | Directory | demo.user · standard account · no admin rights | Argues against an admin script. |
| C3 | Threat intelligence | update.example.invalid · 203.0.113.45 · no known reputation | No match is recorded as unknown — not as clean. |
| E1 | Endpoint · process creation | WINWORD.EXE → powershell.exe -NoProfile -EncodedCommand […] | An Office process started PowerShell with an encoded command. |
| E2 | PowerShell · script block log | Decoded script requests https://update.example.invalid/… | Remote content requested from an unfamiliar domain. |
| E3 | DNS | update.example.invalid → 203.0.113.45 | Resolution right after the script ran. |
| E4 | Firewall | WS-DEMO-014 → 203.0.113.45:443 · 3 sessions in 40 s | Outbound connection to the resolved address. |
Rebuilt from the evidence records. Times are synthetic.
Likely true positive
High
An Office process launched encoded PowerShell that requested content from an unfamiliar domain, then opened outbound sessions to it. The sequence is consistent with a malicious document fetching a second stage.
Was demo.user expecting an invoice document from an external sender this morning?
Isolate WS-DEMO-014 from the network
Stops further outbound sessions while the host is examined. E4C1
Awaiting human approval
Named, authorized approver (on-call L2)
Controls shown for illustration. Nothing can be executed from this page.
Nothing has been executed. The decision and the approver will be written to the decision ledger.
Conceptual product preview — not a screenshot of the product interface
02How it works
Every alert follows the same pipeline. Each stage hands the next a defined output, so you can always see where a conclusion came from.
Raw SIEM/SOAR alerts are converted into a common schema. Deterministic pre-triage filters known patterns without a model call.
Output Normalized alert
Asset, user and external threat-intelligence context is gathered in parallel.
Output Context bundle
Hypotheses, read-only evidence queries and a timeline; classification with confidence and rationale; MITRE ATT&CK mapping.
Output Evidence-referenced findings
Output is checked a second time before it reaches the customer. Findings without a basis do not enter the report.
Output Reviewed verdict
Response steps with blast radius and reversibility, an approval gate, and a Turkish or English report with an attack-flow diagram.
Output Action plan and report
Your team asks follow-up questions about the case through a signed, time-limited link.
Output Answers on the record
Across every stage
Customer-specific and isolated. Every case is written here; similar incidents start with past context.
Evidence classification · approval gate · decision ledger · tenant isolation · input sanitization · quality measurement.
Assesses operational safety impact in industrial environments: production continuity, physical damage and human safety. Includes industrial protocol parsing.
03Specialist areas
AISOC selects the specialist each question needs. All of them work under the same governance layer.
A defensible account of the incident, with the record behind every statement.
Response options sized to their impact, and a clear line where the AI stops.
Reports people can act on, and detections that close the gap.
A red-team agent is in development. See the roadmap under Detection engineering.
04Governance
AISOC never applies a modifying action on its own. What happened, which evidence supports it, which control it passed and who approved it stay linked — and can be replayed after the fact.
01 What happened
Encoded PowerShell from an Office process, then outbound sessions to update.example.invalid.
02 Which evidence
Process creation, script block, DNS and connection records.
E1E2E3E4
03 Which control
Policy check: 1 asset, no privileged account, reversible. Eligible for approval.
04 Who approved
A named, authorized approver. Decision and identity are recorded.
Pending
Approval chain
Policy check covers blast radius, reversibility and privilege.
Every statement comes with the record it is based on. A finding whose basis cannot be shown does not enter the report.
Every piece of evidence is stamped with the customer it belongs to; unstamped evidence is rejected. Permissions and data are separated per tenant.
Blast radius, privilege and reversibility are assessed before a step is proposed. Blocking your own infrastructure, or an irreversible action on a privileged account, is never put forward.
Every modifying action goes to a named, authorized person and the approval is recorded. Investigation queries are read-only.
A chained decision ledger lets you replay why a decision was made, in plain language.
Supporting safeguards
Log fields can be written by an attacker. Every text sent to the model passes through a single gate and is sanitized.
An address or technique the model cites must actually have been observed. ATT&CK claims are validated against a fixed catalog.
05Deployment
AISOC is installed on your own infrastructure. The model layer is interchangeable: a local LLM by default, or a cloud LLM where your data classification and security policies allow it. Evidence and approval controls stay the same either way.
On your hardware, as containers. Comes up without external connectivity.
Read-only connection to your existing infrastructure. Your setup does not change.
Pre-filtering → investigation → evidence-backed classification → report with attack-flow diagram.
Every modifying action is put to a named person, and the approver is recorded.
Each case is written to customer-specific memory, so similar incidents start with context.
06Detection engineering
Describe a behavior in plain language and AISOC drafts a Sigma rule, then translates it into queries for the SIEMs in your environment. Every draft carries a risk note and goes to an engineer for review.
Available today
title: Office application starts encoded PowerShell
status: experimental
description: Draft from case DEMO-0417. Review before use.
logsource:
category: process_creation
product: windows
detection:
parent:
ParentImage|endswith:
- '\WINWORD.EXE'
- '\EXCEL.EXE'
child:
Image|endswith: '\powershell.exe'
CommandLine|contains:
- ' -enc'
- ' -EncodedCommand'
condition: parent and child
falsepositives:
- Office add-ins that start PowerShell
level: highQuery drafts for SplunkQRadarElasticMicrosoft Sentinel
Risk note Legitimate Office add-ins that start PowerShell will match. Review exclusions before enabling.
07Questions
No. AISOC works on the alerts your SIEM/SOAR already produces. It converts them into a common schema and connects read-only to your existing infrastructure for investigation, so your setup stays as it is. Sources and connection methods are confirmed for your environment during scoping.
No modifying action is applied on its own. AISOC prepares response steps — isolating a host, disabling an account, terminating sessions, resetting a password, blocking an indicator or quarantining a file — assesses blast radius, privilege and reversibility, and submits each one to a named, authorized person. The approval is recorded.
Not in an on-premises deployment: the whole system, including the model, runs inside your infrastructure. A cloud LLM is used only where your data classification and security policies permit; in that case, content sent to the model is processed by the provider you choose. Threat-intelligence lookups never send internal addresses out.
Yes. AISOC is installed as containers on your own hardware, needs no external connectivity and can run in air-gapped environments.
Case reports are produced in Turkish and English, in plain language, and each includes an attack-flow diagram. Other report languages are not part of the current scope.
Yes, through a dedicated OT/ICS track that assesses an incident’s operational safety impact: production continuity, physical damage and human safety. The track includes industrial protocol parsing, and an OT/ICS safety specialist assesses what an incident means for the production line.
Each statement cites the record it rests on, and findings without a basis stay out of the report. Addresses and techniques the model cites must actually have been observed, and ATT&CK claims are validated against a fixed catalog. A quality review runs before output reaches you, and every modifying action still needs human approval. No AI system is error-free; AISOC is built so that errors are visible and reviewable.
08Request a demo
Tell us about your SOC environment. We will walk you through an investigation and the deployment option that fits your data policies.
What the demo covers