- 
- 
- 
+ 
+ 
+ 
-
+# Vyrox + +**The autonomous, auditable action layer for security operations.** + +Detection is solved. Response is not. An alert fires, lands in a queue, and at 2am +nobody is home. When someone does act, no one can reconstruct afterward what was +done or why. Teams bought detection and were left alone with the hard part. -## What It Does -Vyrox is the slightly overcaffeinated AI SOC analyst that reads the alert queue, squints at it, and then asks a human before touching anything dangerous. +Vyrox acts on the alert and proves it. We triage every EDR alert, take action on the +ones that are real, and write every action to a tamper-evident log the customer owns. + +## How it works ``` -[EDR Alert] --> [Ingest] --> [Heuristics] --> [LLM triage] --> [Human Approval] --> [Action] +[EDR alert] -> [Ingest] -> [Heuristics] -> [LLM triage] -> [Decide] -> [Act] -> [Audit] ``` -1. **Ingest** - CrowdStrike and SentinelOne webhooks arrive like they pay rent here. -2. **Triage** - Deterministic heuristics handle most of the obvious nonsense. -3. **Escalate** - Ambiguous cases get a second opinion from the LLM. -4. **Approve** - HIGH/CRITICAL alerts surface with enough context to make a sane decision. -5. **Execute** - Approved actions hit the hardened Rust proxy, because chaos deserves guardrails. +1. **Ingest** - CrowdStrike, SentinelOne, Defender, and a field-mapped generic adapter post alerts to a per-tenant webhook, authenticated with HMAC-SHA256. +2. **Triage** - A deterministic heuristics engine clears the obvious noise in milliseconds. Only the genuinely ambiguous alerts reach an LLM, which writes verdict fields and never executes anything. +3. **Decide** - Human approval by default. Autonomous only where the customer has turned it on and the action is reversible. +4. **Act** - Approved containment runs through a small, hardened Rust proxy: signed, rate-limited, and built to fail closed. +5. **Prove** - Every action lands in a SHA-256 hash-chained audit log the customer owns, ready for an auditor or an insurer. -The important bit: **no autonomous containment**. Humans approve before anything gets isolated, killed, or dramatically overreacted to. +## Who it is for -## Repositories +Sold MSSP-first: one analyst runs many client tenants from a single console and can +prove every action to each client's auditor. Lean in-house teams that own security but +have no 24/7 SOC come in through the inbound door. -| Repo | Description | License | Stars | -|------|-------------|---------|-------| -| [vyrox-proxy](https://github.com/vyrox-security/vyrox-proxy) | Rust containment proxy for the important kind of panic | MIT |  | -| [vyrox-docs](https://github.com/vyrox-security/vyrox-docs) | Architecture docs for the stuff everyone pretends not to read | Proprietary |  | -| [vyrox-simulator](https://github.com/vyrox-security/vyrox-simulator) | Alert simulation, because production is a terrible place to improvise | Proprietary |  | -| [vyrox-landing](https://github.com/vyrox-security/vyrox-landing) | Public marketing site with just enough polish to be dangerous | Proprietary |  | +## Open core -## Why Open Core +The execution proxy is MIT licensed. If a piece of software can isolate a production +host, the people running it should be able to read exactly what it does before they +trust it. The heuristics corpus and the orchestration core stay private: that is the +product, and handing detection logic to attackers helps no one. -The proxy is MIT because if software can isolate a production host, the public should at least be able to audit the melodrama. +## Repositories -The heuristics stay proprietary because that is the actual product, and shipping detection logic publicly would be a very generous gift to the other team. +| Repo | What it is | License | +|------|-----------|---------| +| [vyrox-proxy](https://github.com/vyrox-security/vyrox-proxy) | Rust containment proxy, the audited execution boundary | MIT | +| [vyrox-docs](https://github.com/vyrox-security/vyrox-docs) | Public architecture, API contracts, threat model, audit-chain spec | Proprietary | +| [vyrox-simulator](https://github.com/vyrox-security/vyrox-simulator) | Deterministic alert simulation for exercising the pipeline | MIT | +| [vyrox-www](https://github.com/vyrox-security/vyrox-www) | Public product site | Proprietary | -## Quick Links +## Contact - Website: [vyrox.dev](https://vyrox.dev) -- Security issues: vyrox.sec@proton.me -- PGP key: [vyrox.dev/.well-known/pgp-key.txt](https://vyrox.dev/.well-known/pgp-key.txt) -- Report vulnerabilities: [SECURITY.md](https://github.com/vyrox-security/.github/blob/main/SECURITY.md) +- General: hello@vyrox.dev +- Security: security@vyrox.dev (see [SECURITY.md](https://github.com/vyrox-security/.github/blob/main/SECURITY.md) and the [PGP key](https://vyrox.dev/.well-known/pgp-key.txt)) ## Status -Alpha. Breaking things. Moving fast. Wearing a hard hat. +Alpha. Shipping today: the Rust proxy, ingestion, two-stage triage, human-approved +containment, and the SHA-256 audit chain. In active build: the operational console, +graduated autonomy, and the evidence engine. @@ -66,4 +79,4 @@ Alpha. Breaking things. Moving fast. Wearing a hard hat. --- -Built for analysts who deserve real signal, not 300 false positives per shift. +Built for analysts who deserve real signal, not 300 false positives a shift.