# CISPAR SOC

Autonomous Security Operations Center (SOC) agent — L1, L2, and L3 tiers with MITRE ATT&CK detection, CACAO playbooks, ML anomaly detection, and automated incident response.

Runs entirely on your infrastructure. No logs or security data leave your network.

## What it does

- **L1 Triage** — monitors events, parses logs, enriches IOCs, classifies threats
- **L2 Response** — contains compromised hosts, collects evidence, executes playbooks
- **L3 Hunt** — proactive threat hunting, coverage gap analysis, hardening recommendations
- **Anomaly Detection** — Groq-powered ML critic flags unusual patterns
- **Incident Reports** — executive summaries and technical reports on demand
- **MITRE ATT&CK mapping** — every detection linked to tactics and techniques

## Requirements

- Node.js >= 22.12.0
- A CISPAR license (contact us at soporte@cispar.io)
- An LLM API key (Groq, Gemini, DeepSeek, OpenAI, or Anthropic)

## Installation

```bash
npm install -g cispar-soc
```

## Getting started

```bash
# 1. Authenticate with your CISPAR license
cispar login

# 2. Configure the agent (select LLM, enter API key)
cispar onboard

# 3. Start the SOC agent
cispar gateway
```

The agent runs locally on port `18789`. Connect your terminal frontend to `http://localhost:18789`.

## Install as a system service (always on)

```bash
cispar onboard --install-daemon
```

This registers CISPAR as an OS service so it starts automatically on boot.

## Available commands

| Command | Description |
|---------|-------------|
| `cispar login` | Authenticate with your license |
| `cispar logout` | Sign out |
| `cispar whoami` | Show active account |
| `cispar onboard` | Interactive setup wizard |
| `cispar gateway` | Start the SOC agent |
| `cispar status` | Check agent health |

## Supported LLM providers

| Provider | Model |
|----------|-------|
| Groq | compound-beta |
| Google | Gemini Flash |
| DeepSeek | DeepSeek V3 |
| OpenAI | GPT-4o |
| Anthropic | Claude 3.5 Sonnet |

## Architecture

```
cispar-soc (this package — runs on your machine)
  │
  ├── L1 Triage     monitor, parse, enrich IOCs, classify
  ├── L2 Response   contain, investigate, collect evidence
  ├── L3 Hunt       threat hunt, gap analysis, harden
  ├── Network       port scan, kill process, vuln scan
  ├── Anomaly       Groq ML critic
  └── Report        incident reports, executive summaries
```

## Security model

- All processing is local — your security data never leaves your network
- LLM API calls go directly from your machine to your chosen provider
- License validation only checks account status, no telemetry

## License

MIT — see [LICENSE](LICENSE)

## Support

soporte@cispar.io