CtrlSec unifies security training, autonomous SOC + MDM, and compliance advisory on a single agent and a shared AI threat intelligence pipeline — with no external API dependency and no integration overhead.
SIEM + EDR + MDM + Training + Compliance + Threat Intel — siloed, duplicated alerts, no shared context.
Manual triage, cross-tool pivoting, and ticket queues let threats persist for days before containment.
Alert fatigue is the #1 reason real threats are missed. Noise wins when tools don't share context.
Compliance tools never see real endpoint state. Gap analysis stays manual, spreadsheet-driven, stale.
// AI Engine — multi-factor scoring (<100ms, no external API)
const factors = {
ioc_match: 35, // domain/ip/hash/cmd in IOC database
yara_match: 30, // one of 700+ YARA signatures fired
behavioral_delta: 18, // z-score vs 30-day entity baseline
parent_anomaly: 8, // non-standard parent process chain
telemetry_spike: 9, // CPU/mem spike during event window
};
// Auto-response thresholds:
// score ≥ 80 → CRITICAL → ISOLATE_NETWORK (auto, <1s)
// score ≥ 60 → HIGH → RUN_SCAN (auto)
// score ≥ 40 → MEDIUM → analyst queue
// score < 40 → LOW → log onlyGET /api/agent/intel
X-Agent-ID: agt_8f2a1c3d // entity resolved from agent_agents
HTTP/1.1 200 OK
{
"version": "20260321-14", // increment triggers re-download
"domains": ["c2.malware.xyz", "exfil.bad-actor.ru"],
"ips": ["185.220.101.47"],
"hashes": ["d41d8cd98f00b204e9800998ecf8427e"],
"commands": ["mimikatz", "invoke-mimikatz", "sekurlsa"],
"yara_rules": {
"malware_mimikatz_generic.yar": "<base64>",
"malware_cobalt_strike_beacon.yar": "<base64>",
"ransomware_wannacry.yar": "<base64>",
// ... 20+ more rules entity-scoped ...
"custom_corp_detection.yar": "<base64>"
}
}One-line install → self-registers via POST /api/agent/register with agent_id + hostname + OS
GET /api/agent/intel with X-Agent-ID → entity-scoped IOC + 700+ YARA signatures returned
POST /api/agent/heartbeat every 30s carrying telemetry metrics + batched event list
Platform scores each event in <100ms: IOC(35) + YARA(30) + behavioral(18) + chain(8) + telem(9)
Score > threshold → SSE event broadcast to all console clients → analyst queue updated
MDM policy conditions met → action queued → agent polls next heartbeat → executes in <1s
Analyst reviews ranked threat queue → approves / escalates / closes with notes
JSON + PDF report export → compliance scores auto-update → Strategy module receives data
A single tamper-protected binary covers SOC telemetry, MDM enforcement, YARA scanning, and command execution. Competitors ship one agent per product — we ship one for all three.
The threat engine scores every event in <100ms using multi-factor analysis — no cloud LLM, no API latency, no per-token cost at scale. Built-in, entity-isolated, always deterministic.
Console clients receive threat events, endpoint updates, and command results in milliseconds via Server-Sent Events. No poll intervals, no missed alerts, no stale dashboards.
Create, test, enable, and distribute YARA rules from the console. Each agent receives only its entity's rules. 700+ built-in detection signatures across 24+ rules out of the box.
Alpha challenges are built from the same IOC patterns and YARA signatures as Console's production threat database. Analysts trained in Alpha arrive in Console already familiar with real threats.
Strategy compliance scores are computed from real Console endpoint data — screen lock, threat score, idle time, software inventory. Scores update on every heartbeat. Never stale.
| CAPABILITY | CTRLSEC AGENT | TRADITIONAL AGENTS |
|---|---|---|
| Protocol | HTTPS/TLS 1.3 · single endpoint | Multiple agents, multiple protocols |
| OS support | Windows · Linux · macOS — one binary | Often separate binaries per OS |
| SOC + MDM in one | ✓ unified — same heartbeat | × two separate agents, two queues |
| YARA scanning | ✓ 700+ signatures, per-entity | × add-on module or separate product |
| Intel bundle delivery | ✓ versioned, entity-scoped, 30s TTL | × manual push or polling interval |
| Compliance feed | ✓ live endpoint state on each heartbeat | × snapshot-only or manual import |
| AI scoring | ✓ <100ms, no external API, no cost | × cloud API, latency, per-event cost |
| Remote shell | ✓ encrypted, no VPN, no SSH keys | × separate privileged access tool |
| Tamper protection | ✓ FIM + self-monitor + lockdown | × varies widely by vendor |
| SSE real-time push | ✓ always-on, 0 poll delay | × polling every 30–60s at best |
POST /api/agent/heartbeat
X-Agent-ID: agt_8f2a1c3d
{
"hostname": "WIN-CTRLSEC-01", "version": "1.4.2",
"telemetry": {
"cpu_percent": 34.2, "memory_percent": 67.8,
"disk_percent": 45.1, "process_count": 187,
"battery_percent": 82, "wifi_ssid": "CORP-5G"
},
"events": [{
"type": "process_start", "pid": 4821,
"name": "powershell.exe",
"args": "-EncodedCommand JABzAD0ATgBlAHcA..."
}]
}
// ← Platform responds with commands + intel version
{
"ok": true, "interval": 30,
"commands": [{ "id": "cmd_9a3b", "action": "RUN_SCAN" }],
"intel": { "version": "20260321-14", "has_update": false }
}| SHARED COMPONENT | ALPHA | CONSOLE | STRATEGY |
|---|---|---|---|
| Agent binary | — | ||
| IOC database | — | ||
| 700+ YARA signatures | — | — | |
| AI threat engine | — | ||
| SSE event bus | — | ||
| MongoDB data pipeline | |||
| Telemetry stream | — | ||
| Compliance scoring | — | ||
| Audit trail | |||
| Entity isolation |
The CtrlSec Brain is a 50→32→16→20 multi-label MLP trained entirely on your organisation's data. No cloud LLM. No per-token cost. No vendor dependency. Just deterministic, entity-isolated threat intelligence.
Combines VAPT findings, red team TTPs, dark web credential signals, supply chain risk scores, brand monitoring activity, and live console threat velocity into one unified 50-dimensional representation fed to the MLP on every inference call.
20 simultaneous attack pattern predictions in a single forward pass. Focal loss (γ=2) with POS_WEIGHT=8 prevents class collapse at ~5% positive rate per output. AdaGrad per-weight adaptive learning rate. 78%+ Macro F1 out of the box.
Every analyst action, new VAPT finding, dark web alert, console threat, and red team event is a training signal. emitTrainingEvent fires non-blocking after every record. The model gets smarter with your data — never with your API calls.