Product
The investigation layer for the SOC you already have.
Locard ingests alerts from your tools, investigates each one through governed tool calls, reaches a verdict it can defend, and proposes the response. Here is what is built today, and what comes next.
Inbox
Locard investigates first. You see the answer.
Every alert becomes a case. By the time you open it, Locard has a verdict, a confidence and a proposed action, sorted into what needs you, what is in progress and what closed on its own.
Built today
What is in the product now.
Everything below exists in the codebase and is covered by its tests. It runs end to end on the Synthetic SOC, our vendor-shaped simulators; nothing here depends on a slide.
Intake and cases
- Signed webhooks (HMAC, timestamp tolerance, replay cache) and cursor-based pollers with backfill.
- Every alert normalised to OCSF 1.9, with the raw payload and its SHA-256 kept.
- De-duplication and grouping into cases by shared entities and time, with hub entities excluded. An alert storm of 50 or more collapses into a handful of cases.
- Two-way status sync: the verdict and a comment go back to the source.
Investigation engine
- One durable workflow per case (Temporal): phases, budgets, approvals that can wait, timers. It survives a worker restart mid-investigation.
- Eight skill families: phishing, BEC inbox rule, impossible travel, MFA fatigue, OAuth consent, password spray, suspicious PowerShell, EDR malware.
- Query intents compiled to KQL and SPL, validated before they run, read-only, time-bounded and row-capped. A truncated result is never read as “nothing found”.
- Every verdict records what evidence would change it.
Verdicts and evidence
- The skill’s rubric decides the verdict and the model proposes. Required questions must be answered with data before anything closes as benign.
- Every claim cites evidence IDs; a checker rejects uncited claims. Every evidence item records its query, connector, time range, result hash and trace span.
- Connector-gap records name the missing source and the questions it would have answered.
- Frozen-evidence replay reproduces the identical verdict and evidence hashes.
Response and approvals
- Typed capabilities mapped to each vendor’s API: isolate a host, revoke sessions, suspend a user, remediate a message.
- Tiers T0 to T4 enforced by Cedar policy at the gateway and the API. T2 needs one approver; T3 needs two different people with written reasons; T4 is always denied.
- Approved containment runs as a lease that expires and escalates, with rollback handles.
- A kill switch per workspace and per connector.
Models, your choice
- A thin model router with adapters for Anthropic, OpenAI and Google, and OpenAI-compatible endpoints for xAI, DeepSeek, Fireworks, Together, OpenRouter, vLLM and Ollama.
- A model policy per workspace: provider allow and deny lists, residency and zero-retention tags, keys by reference only.
- Chinese-origin model families are off by default, and PRC-hosted endpoints are never used.
- A redaction hook before model calls, cost metering per call, and cyber refusals routed to another model or a person.
Console and access
- Inbox, Investigation L0 to L5, Approvals, Connectors, Policies, Audit and Settings. Keyboard-first, with ⌘K. WCAG 2.2 AA, checked with axe.
- OpenID Connect sign-in. Roles (viewer, analyst, approver, detection engineer, admin, auditor) are Cedar decisions, and approving is separate from reading.
- Tenant isolation enforced and tested at the database (row-level security), the API and the gateway.
- A hash-chained audit log with a verify endpoint and OCSF export.
Verdicts
Five verdicts. One word each.
Each verdict has its own glyph and word, so colour never carries the meaning alone. Confidence rides beside it, and “inconclusive” always names what was missing.
- Malicious A true positive: the activity is an attack.
- Policy violation Not an attack, but against your policy.
- Benign Real activity that is expected or authorised.
- False positive The detection fired on something that did not happen as described.
- Inconclusive Not enough data to decide, with the source that would have decided it.
Approvals
Containment waits for a person.
Each approval card shows the target, the connector, the policy and the effect in one sentence. Two-person actions show both slots and need a written reason. Approved containment runs under a lease that reverts unless someone keeps it.
Trace
Down to the model call.
The L4 trace is OpenTelemetry GenAI spans: every model call, tool call, guardrail and policy decision, with tokens, cost and timing. Export the audit trail to your SIEM and watch the AI in your own tools.
Coming soon
Next on the roadmap.
Not built yet, and labelled that way. Today Locard runs as a Docker Compose stack, with a Helm chart in the repository, for design-partner pilots.
- coming soon
Managed SaaS
Region-pinned cells, starting with the US and the EU.
- coming soon
Your cloud (BYOC)
The data plane in your VPC, from the same Helm chart.
- coming soon
SAML SSO and SCIM
Per-customer identity providers and provisioning.
- coming soon
Slack and Teams approvals
Approve from where the team already works, approver-only buttons.
- coming soon
More connectors
Google SecOps, Cortex XSIAM, SentinelOne, Elastic, AWS and more.
- coming soon
Public benchmark
Live-model results with miss rates and cost, reproducible.
Bring us an alert. We’ll show you every step.
A walkthrough of the console on synthetic data: the queries, the evidence, the verdict and the approval, end to end. Then we talk about your stack.