CISPAR SOC

Autonomous Security Operations Center (SOC) agent — L1, L2, and L3 tiers with MITRE ATT&CK detection, CACAO playbooks, ML anomaly detection, and automated incident response.

Runs entirely on your infrastructure. No logs or security data leave your network.

What it does

• L1 Triage — monitors events, parses logs, enriches IOCs, classifies threats
• L2 Response — contains compromised hosts, collects evidence, executes playbooks
• L3 Hunt — proactive threat hunting, coverage gap analysis, hardening recommendations
• Anomaly Detection — Groq-powered ML critic flags unusual patterns
• Incident Reports — executive summaries and technical reports on demand
• MITRE ATT&CK mapping — every detection linked to tactics and techniques

Requirements

• Node.js >= 22.12.0
• A CISPAR license (contact us at [email protected])
• An LLM API key (Groq, Gemini, DeepSeek, OpenAI, or Anthropic)

Installation

npm install -g cispar-soc

Getting started

# 1. Authenticate with your CISPAR license
cispar login

# 2. Configure the agent (select LLM, enter API key)
cispar onboard

# 3. Start the SOC agent
cispar gateway

The agent runs locally on port 18789. Connect your terminal frontend to http://localhost:18789.

Install as a system service (always on)

cispar onboard --install-daemon

This registers CISPAR as an OS service so it starts automatically on boot.

Available commands

| Command | Description | |---------|-------------| | cispar login | Authenticate with your license | | cispar logout | Sign out | | cispar whoami | Show active account | | cispar onboard | Interactive setup wizard | | cispar gateway | Start the SOC agent | | cispar status | Check agent health |

Supported LLM providers

| Provider | Model | |----------|-------| | Groq | compound-beta | | Google | Gemini Flash | | DeepSeek | DeepSeek V3 | | OpenAI | GPT-4o | | Anthropic | Claude 3.5 Sonnet |

Architecture

cispar-soc (this package — runs on your machine)
  │
  ├── L1 Triage     monitor, parse, enrich IOCs, classify
  ├── L2 Response   contain, investigate, collect evidence
  ├── L3 Hunt       threat hunt, gap analysis, harden
  ├── Network       port scan, kill process, vuln scan
  ├── Anomaly       Groq ML critic
  └── Report        incident reports, executive summaries

Security model

• All processing is local — your security data never leaves your network
• LLM API calls go directly from your machine to your chosen provider
• License validation only checks account status, no telemetry

License

MIT — see LICENSE

Support

[email protected]