How it works

1. 01ObserveSignals are normalised into one event shape, whatever emitted them.
2. 02UnderstandRelated events become one incident with a causal chain, each step mapped to an ATT&CK technique and citing the signal it rests on.
3. 03PredictBlast radius over observed access — what else this can reach.
4. 04DecideEach action is scored and assigned a tier before anyone sees it.
5. 05ActExecution requires a verdict. There is no path around the policy engine.
6. 06VerifyObserved state is compared against what the action said it expected.
7. 07LearnOutcomes are recorded against the prediction that preceded them.

Most tools stop after the second. Everything from Decide onwards is what makes the difference between explaining an incident and closing it.

Sati, the investigation agent, runs on nine models designed and trained in this project on public data. Each is tested on data held out from training, against the strongest simple baseline found, and none of them decides on its own: every action still needs the policy engine’s verdict.

• Metric anomaly detection — learns what normal looks like for every series · Shailaputri · Observe
• Embeddings for memory — maps observed behaviour to the known technique it resembles · Brahmacharini · Remember
• Network intrusion alerting — flags attack traffic by family · Chandraghanta · Observe
• Writes the structured hypothesis and explanation — Sati's own language model · Kushmanda · Explain
• Proposes the protective response — Dharma still authorises it · Skandamata · Act
• Root-cause ranking — names the service at fault and the fault type, citing the metric series · Katyayani · Understand
• Log anomaly detection — what hides in the noise · Kalaratri · Observe
• Verification — confirms a system has truly returned to normal after an action · Mahagauri · Verify
• Fusion — combines several detectors into one calibrated verdict · Siddhidatri · Decide

What the measurements showed — including where a simple baseline won.

Each step in a causal chain carries the technique it corresponds to, so a reader who does not recognise a described behaviour can go and read what it is. The identifier is a citation, not a finding — it says what a step resembles, not that the step is proven.

• T1595.002Vulnerability Scanning· Reconnaissance
• T1190Exploit Public-Facing Application· Initial Access
• T1195.002Compromise Software Supply Chain· Initial Access
• T1566.002Spearphishing Link· Initial Access
• T1053.005Scheduled Task· Persistence
• T1078Valid Accounts· Persistence
• T1078.004Cloud Accounts· Defense Evasion
• T1003OS Credential Dumping· Credential Access
• T1110.004Credential Stuffing· Credential Access
• T1528Steal Application Access Token· Credential Access
• T1021.002SMB/Windows Admin Shares· Lateral Movement
• T1210Exploitation of Remote Services· Lateral Movement
• T1114.002Remote Email Collection· Collection
• T1071.001Web Protocols· Command and Control
• T1561.002Disk Structure Wipe· Impact

Every technique the library carries — 15 across 9 tactics. The whole matrix, with the tactics nothing was written to show →

Risk starts from the action’s own score and rises with the situation: how far the blast radius reaches, how confident the diagnosis is, whether the action can be undone, and whether it has been run here before. Adjustments only ever raise it — an action cannot argue its way into a lower tier — and a blast radius over 5 entities or 1000 users escalates it a whole tier on its own.

The 25 registered actions and their scores →

18/25

declare a rollback

An action states how to undo it before it is allowed to run. The exceptions are the reads and the ones that are irreversible by nature.

2

change nothing

Read-only is declared on the action, not inferred from its risk — which is why the assistant can be given these and nothing else.

3

irreversible

Marked as such and never autonomous, whatever their score. There is no undo to declare.

One flag is one accident away from a production outage, so live execution needs two independent things to be true at once.

●Dry runshut

On. Actions are evaluated and recorded; nothing executes.

●Environment on the live listshut

No environment is listed as live. This one reports itself as "dev".

Both must open before anything runs. On this deployment neither does, which is why every verdict you see here is a decision that was recorded rather than carried out.

Observations, hypotheses, decisions, approvals, executions and verifications are append-only records, written before an action runs rather than after. Every citation on this site resolves to the event it names, and every answer the assistant gives is checked against what was actually retrieved before it is shown.

• The audit trail — 73 records, and every agent turn carries the model, the prompt version and the lookups it made.
• The Observatory — real advisories from CISA and abuse.ch, polled hourly, each linked to the publisher. A community report is never labelled confirmed.
• Blue team mode — work an incident yourself and see whether the reasoning holds up when you are the one doing it.

Pashupatastra is Lord Shiva’s weapon. In the epic, Arjuna earns it and never uses it — it is held back, not fired. That is the design here: the system can name drastic actions, and everything around it exists so that it proposes them and waits.

Sati, the investigation agent, is named for Mata Sati, Shiva’s consort, the goddess later born as Parvati. The engines are deterministic and decide nothing on their own; Sati is what brings them to bear — and still only proposes. The policy engine authorises.