Authorized attack-surface discovery
Passive discovery and scoped scanning patterns for assets whose ownership and authorization are explicitly documented.
Cybersecurity subscriptions · pre-production validation
Security services built for evidence and control.
SOCRoot is an independent cybersecurity product initiative developing automatable subscription services for smaller organizations. Each service must deliver measurable, repeatable customer value while keeping maturity, risk, authorization, and operational limits explicit.
Pre-production
Current maturity
HITL
Sensitive actions
Dry-run
Default response mode
Subscription
Commercial model under validation
synthetic-lab@socroot:~$Demonstration only
›[DEMO] Synthetic alert received from an isolated lab source.
›[TRIAGE] Evidence linked; confidence and uncertainty recorded.
›[POLICY] RFC1918/CDN address detected: automatic blocking denied.
›[HITL] Sensitive action queued for explicit operator approval.
›[DRY-RUN] Proposed response validated without changing a live system.
›[EVIDENCE] Decision, outcome, and rollback notes stored for review.
Service foundations
Automatable capabilities with explicit boundaries
These capabilities are being tested as building blocks for subscription services—not presented as an unattended, production-grade managed SOC.
Evidence-centered alert triage
A workflow for enriching findings, reducing noise, recording decisions, and keeping the original evidence traceable.
Human-controlled response
Sensitive remediation is proposed in dry-run mode and requires an operator decision, an audit record, and a rollback path.
Security telemetry integration
Engineering work around Wazuh, case management, and alert transport, with production claims gated by deployment evidence.
Audit-friendly reporting
Structured findings, remediation context, and decision evidence designed to make technical work reviewable by operators and stakeholders.
Modular system boundaries
Explicit boundaries between the SOCRoot product surface, its candidate control plane, reusable assets, and the separate Project Synapse graduation project.
Operating model
A controlled path from signal to evidence
01
Scope
Confirm authorization, asset ownership, exclusions, data-handling rules, and success criteria before any security activity.
02
Observe
Collect security signals through approved sources while preserving timestamps, provenance, and client boundaries.
03
Triage
Enrich and prioritize findings, flag uncertainty, and route high-impact decisions to a human operator.
04
Act and evidence
Apply only approved actions, verify the result, capture evidence, and retain a documented rollback path.
Open engineering record
Inspect the work, not just the claims
The public record separates SOCRoot product work from Project Synapse and labels implementation maturity so each claim can be reviewed in context.
Separate graduation project
Project Synapse
An open-source graduation project combining security operations, data analytics, and a scalable modular architecture.
Open public documentation →Private product engineeringSOCRoot Control Plane Candidate
A candidate foundation for portals, RBAC, client state, evidence workflows, and observability; adoption depends on service validation.
Open public documentation →Private graduation-project engineeringProject Synapse Runtime / POC
Alert ingestion, triage, human approval, and evidence capture for Project Synapse. Reuse by SOCRoot requires an explicit interface and value case.
Open public documentation →Interested in a scoped security service?
Start with a clearly bounded problem, authorization, expected evidence, and the recurring value the service should deliver. Current offerings remain subject to pre-production validation.