Platform overview BlueTeam AI
Autonomous SOC · Threat Intel · UEBA · Knowledge Graph
Every alert scored, investigated and linked into a story.
BlueTeam AI ingests your SIEM and XDR alerts, scores each case on a 0–100 risk index, runs evidence checks, links related cases into attack stories and closes proven noise.
What it does
BlueTeam AI is the front of the Autonomous SOC. Your SIEM or XDR pushes alerts to a signed, per-tenant endpoint; ApexAI stores no SIEM credentials. Alerts are deduplicated and grouped, and suppression rules are counted, never silent.
Each case gets a risk index from 0 to 100 that combines entity risk with asset criticality and is explained factor by factor. The tier — noise, investigate, act or critical — follows from the index and decides who works the case.
For the cases it works, BlueTeam AI checks identity, host, network, data and history, writes down what it checked, and links related cases into attack stories with the likely next ATT&CK steps.
Key capabilities
Signed per-tenant ingest
Webhooks for Elastic, Splunk, Wazuh and CEF, with a per-tenant token, an optional HMAC signature with replay refusal, idempotency, grouping and dry runs.
Sources without an adapter
Records from other systems — syslog, LEEF, key=value, JSON, plain log lines — are kept, mapped to ECS roles by the standard ETL, and read into the SOC once the mapping is active.
A 0–100 risk index
Frequency, diversity, open cases, graph position, reputation, rarity and false-positive history, combined with asset criticality and explained by factor.
Evidence written down
Identity, host, network, data and history checks, recorded so a person can read and verify what the AI looked at.
Attack stories
Related cases linked into stories on an entity graph, with the likely next ATT&CK steps noted.
Noise closed under a calibrated threshold
Tier 0 closes only below a conformal threshold calibrated on your verdicts, only for detections people judged benign before, with sampled QA.
How it works
01
Ingest
Alerts arrive over signed per-tenant webhooks, deduplicated and grouped.
02
Score
Each case gets its risk index; the tier follows from it.
03
Investigate
Evidence checks are run and recorded; related cases are linked into stories.
04
Hand off
Tier 2 cases go to Remediate AI for a proposal; tier 3 cases open an incident for Coordinator AI.
The human approval gate
BlueTeam AI changes no real system. The one thing it does on its own is close proven noise at tier 0, under the calibrated threshold. Containment for tier 2 and 3 cases is proposed through Remediate AI and needs a person’s approval — two people at tier 3.
Licence
- Included in
- Autonomous SOC licence (BlueTeam AI, Coordinator AI and Remediate AI together), Platform, Sovereign
- Licence feature
- module.blueteam_xdr
BlueTeam AI, Coordinator AI and Remediate AI are licensed together as the Autonomous SOC. Every licence includes the Core.
See pricing and licencesWhere it stands today
Running and verified on simulated SIEM days and real Core events. It has not yet run on a customer’s live SIEM: each alert source starts in observe mode.
Run BlueTeam AI in observe mode on your alerts.
It scores, investigates and proposes. Nothing is closed or contained on its own while you measure it.