An LLM‑grounded copilot for Snort IPS/IDS that triages, explains, and proposes safe actions— all with guardrails, audits, and predictable cost.
Stream Snort alerts → enrich with asset context and threat intel → gate the flow → retrieve relevant knowledge → ask the LLM via strict schemas → produce structured, auditable decisions.
Snort Sensors → Shipper → Kafka/NATS → Enrichment → Policy Router
↘ Replay Store → RAG
Policy Router → LLM Service (function calls) → Triage, Summaries, Rule suggestions
↘ SOAR/Ticketing ↘ Rules Staging (git+CI)
Start free. Upgrade when you want supervised automations and scale features.
Your existing Snort/SOAR/EDR stack. We ingest alerts, enrich, route a subset to the LLM, and return structured decisions you can act on.
Not by default. It starts read‑only. You can enable supervised automations for low‑risk actions with approvals and time‑boxed suppressions.
With gating + clustering, customers processing hundreds of thousands to millions of alerts/day keep LLM calls to tens–hundreds per minute.
Yes. Run fully on‑prem or in your VPC with self‑hosted models. We redact and minimize inputs either way.
sid:2100498
Severity: Medium
172.16.30.5:49872 → 10.0.1.12:80
Copilot Summary
This alert indicates a potential server compromise. The string "id check returned root" was detected in traffic from an internal web server (10.0.1.12), which often signifies a successful privilege escalation attack. This pattern is associated with the "Woot" family of worms. Recommend isolating the host and checking running processes for unauthorized activity.
Draft a new Snort rule using natural language.
Generated Rule
alert tcp any any -> $HOME_NET 445 (msg:"ET POLICY SMB traffic from external net"; classtype:policy-violation; sid:2018378; rev:1;)Example reporting dashboard (UI in progress).
Reporting and charting components would be displayed here.