CNSH.DEV
← ALL PROJECTS

XenXDRXDR · SIEM · SOAR

A self-hosted XDR, SIEM and SOAR platform built around AI workflows. Every alert is investigated as it lands and comes back with a verdict, the evidence behind it and a confidence score. A person, or a policy they wrote, makes the call.

ROLE
Solo: design, build, ship
TIMELINE
2024 — PRESENT
STATUS
Early access, design partners
AI
Self-hosted models first
VISIT LIVE ↗CONTACT
01

THE PROBLEM

Most alerts in a SOC are not incidents. They are noise, and someone still has to open each one, gather context from three different consoles and write down why it is fine. That first-line queue is where good analysts burn out. Their time belongs on the real incidents, with the rest arriving already investigated and waiting for a quick sign-off.

AI could work that queue, but most products analyze incomplete data on a model running in someone else's cloud. I wanted the opposite: AI that runs on your own infrastructure, does the grunt work with the right context, can search for more when it needs to, and leaves the final decision to a person.

02

HOW A WORKFLOW RUNS

  1. STEP 01

    ALERT FIRES

    A detection matches. Duplicate matches fold into one alert, and the workflow attached to that detection starts.

  2. STEP 02

    AI INVESTIGATES

    The workflow enriches indicators, pulls related events and checks how similar alerts were resolved, using bounded, read-only queries.

  3. STEP 03

    ADVISORY VERDICT

    Benign, malicious or needs a person, with a confidence score, a recommendation and a grade for how much of the evidence is really about this alert.

  4. STEP 04

    POLICY DECIDES

    • — Clearly benign on strong evidence: closed, trail kept.
    • — Clearly malicious: a case opens with evidence attached.
    • — Anything uncertain waits for a person.
03

WHAT IT CHANGES

01

NOTHING WAITS FOR MONDAY

Every alert is triaged the moment it lands, around the clock. Mornings start with verdicts to review, not a backlog.

02

ALERTS ARRIVE INVESTIGATED

Related activity across hosts, users and network is already gathered and laid out as a graph before an analyst opens the alert.

03

REASONING YOU CAN CHECK

Each verdict cites the evidence it rests on, and the investigation lists every query it ran. Nothing is a black-box score.

04

NOISE CLOSES ITSELF

Recurring benign patterns close automatically, but only under a policy the team sets, with the full trail kept and every closure reversible.

05

THE WRITING IS DRAFTED

Triage notes, shift handovers and the first draft of the customer report are written from what actually happened.

06

IT LEARNS FROM THE TEAM

Every accept or reject feeds back into the prompts for that detection, scoped per customer, so the advice improves with use.

04

WHEN THE AI WAS WRONG

In lab testing, the first version of the AI layer was confidently wrong. It judged a Windows Store app malicious because of an unrelated updater that happened to run next to it, and it showed a rule-based fallback as if it were a model's verdict.

The model was not the problem. The pipeline in front of it was handing over evidence that had nothing to do with the alert. Tuning the model first would have taught it from bad labels, so I fixed the pipeline first and built a way to measure every change.

  • EVERY VERDICT NAMES ITS SOURCE

    If no model ran, the console says "No AI verdict". A fallback never passes for an AI verdict, and it is never used as a training label.

  • EVIDENCE GETS A GRADE

    Each verdict states how much of its evidence is about this alert. A benign call on thin evidence is capped and sent to a person. Auto-close needs strong evidence.

  • AUTOMATION EARNS TRUST PER RULE

    If analysts agree with fewer than 70% of a detection's verdicts, its automatic actions switch off until agreement recovers.

  • NO CHANGE SHIPS UNMEASURED

    A replay harness scores every prompt or model change against curated lab cases and reports agreement, false-benign rate and output validity.

05

INSIDE THE PLATFORM

A XenXDR alert opened for triage: the advisory verdict with its confidence and triage note, the automated steps and their outcome, beside the stage, assignee and SLA panel.
FIG.01 An alert after its workflow ran. The verdict comes with its confidence, an evidence grade, a plain-language note and the steps already taken. The analyst approves what is left.
A XenXDR event graph: a user account and the processes it spawned running left to right into the detections that fired, the addresses and files they touched, and the response action taken against each.
FIG.02 The context the workflow gathered, as a graph: the account, the processes it started, the detections that fired, what they touched and the response to each.
The XenXDR alerts queue: a search bar, a severity timeline and a triage table showing each alert's AI verdict, stage, SLA and assignee.
FIG.03 The alert queue. Every row already carries its AI verdict, so the queue is sorted before anyone opens it.
The XenXDR console Overview: open alerts, the alert pipeline by stage, AI workflow automation and the riskiest hosts.
FIG.04 Overview: open alerts, the pipeline by stage, how much of the queue the AI workflows are handling, and the hosts most at risk.
A XenXDR case: the investigation write-up with an executive summary, affected systems, actions taken and next steps, beside its classification and people.
FIG.05 A case. Escalation carried the evidence over and the AI drafted the write-up, so the analyst edits instead of starting from a blank page.
XenXDR log search: a query across every source, a hit histogram over the last 24 hours and the matching documents with their parsed fields.
FIG.06 Under it all, log search across every source. Any verdict links straight to the documents it rests on.
06

MY ROLE

  • — Wrote the product brief around one rule: AI does the first pass, a person decides.
  • — Designed and built the AI workflow engine: investigation, advisory verdicts, evidence grading, policy-driven actions and the feedback loop.
  • — Built the rest of the platform it runs on, from the Windows and Linux endpoint agent to log search, detections, cases and the console.
  • — Ran it against a lab, turned the AI's wrong verdicts into an evaluation set, and now onboard the first design partners.
07

RESULTS

86%

VERDICT AGREEMENT

0%

FALSE-BENIGN VERDICTS

100%

VALID STRUCTURED OUTPUT

~10s

PER VERDICT, SELF-HOSTED

From the evaluation harness on the curated lab set (weighted, 6 of 7 cases), run against an open-weight model on our own hardware. The set is small on purpose: it catches regressions, and grows with every wrong verdict the lab files.