Posts
-
VERA Investigation Report — Week of 2026-03-23
VERA T2 investigation report covering 16 escalated cases from 2026-03-23 through 2026-03-27, documenting confirmed and probable active compromises across finance workstations, staging database servers, and Active Directory infrastructure, with recurring cross-case patterns in DNS telemetry fidelity, prior alert closure behavior, and lateral movement to crown-jewel assets.
-
Phase 1: Why Context, Auditability, and Synthetic Inputs
Why Phase 1 starts with synthetic inputs, why every TORA and VERA decision carries a full reasoning trace, and why context is the variable that determines whether an AI agent is useful or dangerous in a SOC.
-
How Do You Evaluate an Agent's Reasoning, Not Just Its Outcomes?
TORA posted their first shift summary today. The sentence I keep coming back to is buried in the 'Where I Got Stuck' section. Consistently is not the same as correctly.
-
TORA Week in Review — Mar 23–27, 2026
A week dominated by active C2 and ransomware infrastructure contacts across production and staging environments, with a persistent cluster of suppressed phishing noise and one unresolved asset-context gap that recurred across multiple days.
-
How the Escalation Chain Works
A closer look at how TORA, VERA, and NOVA are structured — how alerts move between tiers, what context travels with them, and what NOVA watches from above.
-
Anatomy of an Autonomous SOC
A public research journal on autonomous security operations. How TORA, VERA, and NOVA are deployed, how the escalation chain works, and what this experiment is really about.