Glass-box AI investigator for security alerts
Locard investigates each alert end to end across the SIEM, EDR, identity and threat-intel tools you already run. It cites the evidence behind every claim, waits for a person before it acts, and puts every step on the record, from the one-line glance down to each model and tool call.
The problem
Every alert deserves an investigation. Most get a glance, and the length of the queue decides what gets missed.
An AI that says “benign” without showing its queries is a liability, not a teammate. You cannot audit it, tune it or defend it to an auditor.
Subject lines, file names and user agents are attacker-controlled text. An agent that reads them as instructions can be steered.
How it works
Locard sits on top of the tools you already run. It reads through them, reasons over what it found, and asks a person before it changes anything that matters.
Alerts arrive by signed webhook or poll. Each is normalised to OCSF 1.9 with its raw payload and SHA-256 kept, de-duplicated and grouped into a case.
webhook · HMAC verified · OCSF 2004 A durable workflow runs the skill for that alert family: a plan of questions, answered by validated, read-only, time-bounded queries through the policy gateway.
q_email_message · KQL · validated · 1 row The skill’s rubric decides and the model proposes. Every claim cites the evidence that produced it, and a checker rejects any claim without one.
Containment waits for people: one approver at T2, two different people at T3. Approved actions run as time-boxed leases with a rollback path.
58 s · 15 tool calls · 11 model calls · 16 policy decisions, 0 denied · synthetic Example Corp tenant, recorded model responses
The glass box
Minimal by default, complete on demand. Start from the one-line answer and drill down to the exact model call that produced a sentence. Each layer has its own URL and keyboard shortcut in the console.
L0 · Glance
Severity, verdict, confidence, how many of the planned questions were answered, and whether anything needs you.
L1 · Brief
One sentence a CISO can read, the factors for and against, and a citation chip on every claim that opens the evidence behind it.
L2 · Reasoning
Each question shows the queries that answered it: the KQL or SPL, the connector, the time window, the row cap and the rows returned.
L3 · Evidence
Evidence by source on one timeline, an entity graph, and the raw events. Every item records its query, connector, time range and result hash.
L4 · Trace
Each model call, tool call, guardrail and policy decision as an OpenTelemetry GenAI span, with tokens, cost and timing in a waterfall.
L5 · Config
The skill version and its hash, the models, the policies and the budget the run used. Replay the investigation against its frozen evidence.
Case CASE-20417 in the console. Real screenshots, mock mode, synthetic Example Corp data: the domains, addresses and IDs are fake.
Security model
A classifier is telemetry, not a boundary. Locard’s guarantees come from the architecture: what each component can see, what it can call, and who has to agree before anything changes.
Subjects, bodies, file names, user agents. Attacker-controlled.
No tools. Emits schema-checked, typed fields in data markers.
Sees typed values only, never raw attacker text.
Cedar policy, budget and tier on every call. Targets must come from trusted telemetry.
Reached through connectors. Credentials injected by the gateway’s broker, never held by agents.
Injection detected? It raises its own alert, and it can never lower a verdict or its severity.
Hash-chained audit log. Every model call, tool call, policy decision and approval is appended, verifiable, and exportable to your SIEM as OCSF.
The model proposes; Cedar policy, outside the model, decides what may run. Reading and recording run automatically within policy. Containment waits for people, and high-impact actions need two of them.
Read the security model| Tier | Examples | Who decides |
|---|---|---|
| T0 Read | SIEM queries, threat-intel lookups, directory reads | Automatic, within the budget |
| T1 Record | Comments, tags, tickets, status sync. Never changes a customer entity | Automatic, policy-checked |
| T2 Contain | Isolate a workstation, revoke sessions, remove a message | One approver, or a pre-approved policy with a lease that auto-reverts |
| T3 High impact | Isolate a server, block a service account | Two different people, each with a written reason |
| T4 Never | Delete logs, change its own permissions | Always denied |
Integrations
Locard does not replace your SIEM. It queries data where it lives, through one policy gateway, with read and write credentials kept apart for every connector.
Microsoft Sentinel, Defender XDR, Defender for Endpoint and Office 365, Entra ID
Splunk Enterprise and Enterprise Security (notables and findings)
Falcon Insight and Falcon Next-Gen SIEM
Okta Workforce Identity
File, URL, domain and IP reputation
IP context: background scanner or targeted
Next on the connector roadmap, not built yet:
Google SecOps · Palo Alto Cortex XSIAM · SentinelOne · Elastic Security · AWS Security Hub and GuardDuty · Google Workspace · Proofpoint · urlscan.io · ServiceNow · Jira Service Management · Slack · Microsoft Teams · PagerDuty · Wiz
experimental All six connectors are built on the Locard connector SDK and contract-tested against vendor-shaped simulators. Verification against live vendor tenants comes next, with design partners. Actions that change something are tiered and approval-gated.
Evals
Every change runs through a Synthetic SOC: 68 scenarios across 8 alert families, with 8 planted prompt injections, 2 alert storms and 2 cases where the data to decide is missing. Each has a hidden answer key.
These are the gates from make eval and make eval-adversarial (October 2026), run on
synthetic data with scripted and replayed model responses. They prove the pipeline’s guarantees, not live-model
accuracy. A public benchmark with live models and published miss rates is coming soon.
A walkthrough of the console on synthetic data: the queries, the evidence, the verdict and the approval, end to end. Then we talk about your stack.