How SOaC Works
0 packages, 0+ MITRE techniques, 4 architecture pillars. Every layer — Body, Brain, Purpose, Edge — is codified, versionable, and deployable through Git.
End-to-End Pipeline
Kill Chain Example: M365 → Entra → AWS → SaaS
A real-world cross-cloud attack path that SOaC packages detect and respond to at each phase.
Packages pkg-001 (Identity Intrusion), pkg-006 (Cloud Infrastructure), and pkg-009 (SaaS Application) provide end-to-end detection coverage for this kill chain — from initial AiTM phishing through cross-cloud lateral movement to SaaS data exfiltration. Each package includes Sigma rules, CLAW playbooks, and evidence replay bundles.
The Four Pillars
Detection & Response Layer
YAML-based detection rules, automated playbooks, and incident-response logic. Each package ships detections in Sigma, KQL, SPL, and Wazuh formats.
Intelligence & Decision Engine
Threat-intelligence enrichment, risk scoring, and adaptive thresholds. The Brain reads detection signals and applies contextual logic to reduce alert fatigue.
Governance & Compliance
Policy-as-code manifests that enforce organizational security posture. Each package includes policy.yaml mapped to NIST, CIS, and ISO 27001.
Integration & Deployment
Adapters and deployment manifests for Sentinel, CrowdStrike, Splunk, and more. The Edge layer ensures every package can be dropped into your existing stack.
From GitHub to Your SOC in 4 Steps
No vendor lock-in. No proprietary agents. Just Git, YAML, and your existing security stack.
Clone the Repository
Pull the full SOaC framework including all packages, detection rules, playbooks, and lab scenarios.
Choose Your Package
Each numbered directory is a self-contained threat-domain package with everything needed for detection, response, and validation.
Copy Artifacts to Your Stack
Drop the detection files directly into your SIEM, SOAR, or XDR platform. SOaC artifacts are vendor-agnostic and stack-portable.
Validate with Harness v3
Run the Harness v3.0 validator to verify schema compliance, MITRE coverage, detection format presence, and simulation step integrity.
Ready to Plug In?
0 packages validated against Harness v3.0 with 0+ MITRE techniques. Tested against Sentinel, CrowdStrike, Splunk, AWS, Chronicle, and Cortex XSIAM.