ERA Control AISOC AI analyst

Automated incident investigation: a chain of related events (storyline), verdict, confidence level, and narrative summary for the analyst, mapped to MITRE. The language model runs inside the customer perimeter — no OpenAI, Copilot, or other cloud APIs. Reduces triage time and lowers the bar for SOC entry.

Purpose

Give the SOC a "second pair of eyes": AI gathers context by host and incident, formulates a hypothesis, and helps the analyst decide. Data never leaves the perimeter.

Key capabilities

• Investigation by host/incident: storyline, verdict, confidence, narrative.
• Local LLM (Ollama / vLLM) — full control over model and data.
• Output mapped to MITRE ATT&CK techniques.
• Integration with ERA Core cases and events.

Who it's for

Organizations with a shortage of senior analysts, banks requiring on-prem AI, "AI in SOC" pilots without data export.

Licensing

Separate ERA Control AI license. Recommended start: Core + AI + Response.