Question 1

What is Jutsu?

Accepted Answer

Jutsu is an AI-driven, autonomous Security Operations Center (SOC) platform. It ingests security events, enriches them with threat intelligence, uses AI to triage and correlate them into incidents, and automatically executes containment, escalating ambiguous cases to human analysts.

Question 2

How is Jutsu different from a SIEM?

Accepted Answer

A traditional SIEM collects and searches logs. Jutsu sits on top of your SIEM and acts on the alerts — it triages each one with an LLM analyst, enriches it, correlates related alerts into incidents, runs automated response playbooks, and writes the reports. It is your Security Operations OS, not just another log store.

Question 3

What products make up the platform?

Accepted Answer

Four products that work together: the AgentSOC Platform (the core autonomous SOC), Red Team (continuous MITRE ATT&CK attack simulation and detection validation), Exposure (a free agentless external security assessment), and Firehose (high-volume SIEM load and throughput testing).

Question 4

Does Jutsu replace my SOC analysts?

Accepted Answer

No. Jutsu automates the repetitive Level 1 and 2 work — triage, enrichment, correlation, and documentation — while analysts stay in control. Ambiguous or failed-containment alerts auto-escalate to human L2/L3 investigation cases, and every action is logged and auditable.

Question 5

Where do the alerts Jutsu works on come from?

Accepted Answer

From Wazuh (via a webhook and a high-throughput Go forwarder that tails alerts.json at up to 20–50k events per second), syslog/beacon sources, and Google Workspace email logs. Splunk, Microsoft Sentinel, and CrowdStrike are on the roadmap as additional sources.

Question 6

Can I test the pipeline before sending real traffic?

Accepted Answer

Yes. The platform includes a built-in alert generator that simulates phishing, brute force, C2 beacons, lateral movement, malware, exfiltration, privilege escalation, and ransomware in Wazuh, Splunk, or generic formats, so you can validate detection and response end to end.

Question 7

How does AI triage decide what is a real threat?

Accepted Answer

A multi-call structured LLM acting as an L2/L3 analyst assigns each alert a summary, category, severity, a 0–100 risk score, a confidence score, and a verdict of true positive, false positive, or not sure — with full reasoning. Only true positives — and ambiguous alerts that clear a confidence threshold — move on to incident correlation.

Question 8

Which AI models does Jutsu use?

Accepted Answer

OpenAI, Anthropic Claude, and Google Gemini are all supported. Each pipeline function — triage, enrichment, correlation, response, incident reporting, org reporting, and Copilot — has its own configurable model slot, with an automatic fallback if a model's quota is exhausted.

Question 9

What automated response actions can the platform take?

Accepted Answer

Through its built-in AgentSOAR engine or Shuffle, it can block an IP, isolate a host, power off an instance (AWS/Azure/GCP/Hostinger), disable a user, and block an email sender or domain (Google Workspace / Microsoft 365). If no playbook matches or no credential owns the target, it escalates to a human L2 case.

Question 10

What is the AI Copilot?

Accepted Answer

The Copilot is a chat assistant grounded in your own alerts and incidents. You select the relevant alert or incident IDs and it answers questions and uses tools against that context, streaming responses live in the dashboard.

Question 11

How does incident correlation work?

Accepted Answer

A dedicated agent groups related alerts into incidents using deterministic key-matching and entity normalization, then applies multi-hop attack-chain playbooks (such as lateral movement and malware origin) with an LLM tie-breaker, before generating reports and orchestrating response.

Question 12

Is the AI making decisions I can't see or override?

Accepted Answer

No. Every verdict carries written reasoning, ambiguous and high-risk cases are escalated to human analysts, and all worker processing and API mutations are recorded in an audit log. AI token usage is also tracked per model and organization for full cost visibility.

Question 13

Is Jutsu self-hosted or SaaS?

Accepted Answer

The core AgentSOC Platform is self-hosted and containerized — it runs via Docker Compose, Dokploy, or Kubernetes (with KEDA queue-depth autoscaling on GKE). Your data lives in your own PostgreSQL, OpenSearch, RabbitMQ, and S3. Red Team and Firehose are delivered cloud-first, and Exposure is an agentless hosted assessment.

Question 14

How is access controlled?

Accepted Answer

Login is via email/password or Google SSO, with role-based access (user, analyst, admin, and super-admin) and admin actions gated to privileged roles. Tenancy is per-organization with row-level isolation, and a database-per-organization, multi-region design is available for deployments that require data residency.

Question 15

How is the Wazuh integration non-invasive?

Accepted Answer

The Go forwarder only tails your existing alerts.json file and reads its API key from the ossec.conf integration block. It uses at-least-once delivery with a single offset file, needs no spool, and starts at end-of-file so it never replays your alert history.

Question 16

What threat-intelligence sources are used?

Accepted Answer

Up to nine during enrichment: VirusTotal, AbuseIPDB, GreyNoise, OTX (AlienVault), MISP, MalwareBazaar, Kaspersky OpenTIP, the CISA KEV catalog, and ip-api.com for geolocation. Results are cached in PostgreSQL to limit repeat lookups.

Question 17

Is data isolated between customers and regions?

Accepted Answer

Yes. Each organization's data is isolated, webhook ingest is authenticated with per-source API keys, and service-to-service routes use a separate service key. A multi-region, database-per-organization topology is available for deployments that require data residency.

Question 18

Is the data Exposure collects safe?

Accepted Answer

Exposure uses only public, non-invasive external signals and is explicitly not a penetration test — it runs no exploit payloads, credential tests, or scans of private IP ranges. Any secrets found in public content or breach data are masked before storage and never logged in clear.

Question 19

Do we have to replace our existing tools?

Accepted Answer

No. Jutsu ingests logs, alerts, and telemetry from your current stack — there is no rip-and-replace. It connects to Wazuh, syslog, and Google Workspace today, with Splunk, Microsoft Sentinel, and CrowdStrike shown as coming-soon sources.

Question 20

What cloud and identity systems can Jutsu act on?

Accepted Answer

For containment it integrates with AWS, Azure, GCP, and Hostinger for instance control, and with Google Workspace and Microsoft 365 to disable users and block email senders or domains. Containment is routed to whichever credential owns the target resource.

Question 21

Can I bring my own API keys?

Accepted Answer

Yes. LLM providers and threat-intel providers are configured per deployment with your own keys. Missing keys degrade gracefully — for example, if no LLM key is present, the response agent simply escalates to a human L2 case.

Question 22

How does Red Team integrate with my SIEM?

Accepted Answer

Red Team emits attack telemetry to AgentSOC via a Wazuh-style webhook ingest URL and API key, and supports Wazuh (Manager API and Indexer). Its generator can format alerts as wazuh, splunk, generic, json, or syslog; Splunk, CrowdStrike, Jira, and Slack are on the roadmap.

Question 23

What does Firehose require on the Wazuh side?

Accepted Answer

Beyond a TCP syslog listener and firewall access, you install the shipped local_decoder.xml and local_rules.xml on the Wazuh Manager so the synthetic events fire rules. Firehose then reads alerts back via the alerts.json file or the Wazuh Indexer to measure latency.

Question 24

How quickly can we get started?

Accepted Answer

Connect your existing sources and the agents begin triaging immediately — there is no lengthy deployment project. You can also run the built-in alert generator to validate the pipeline before pointing real traffic at it.

Question 25

What does Red Team do?

Accepted Answer

Red Team launches realistic, MITRE ATT&CK-mapped attack simulations — brute force, malware, phishing, C2, ransomware, lateral movement, and full APT chains — against scoped lab targets, then correlates the results against your SIEM telemetry to validate whether your defenses actually detected and responded.

Question 26

Is Red Team safe to run?

Accepted Answer

It is safe by design. Runs are scoped to lab/staging/prod environments with safety profiles, destructive scenarios are blocked outside permissive lab environments, prod or destructive launches require two-person approval, unknown targets are rejected, and a global kill switch can stop everything instantly.

Question 27

Does Red Team measure detection performance?

Accepted Answer

Yes. Red Team correlates each run against your SIEM telemetry, recording which expected signals were detected versus missed and computing detection rate plus median and p95 mean-time-to-detect.

Question 28

What is Exposure?

Accepted Answer

Exposure is a self-service, agentless external assessment. You enter your domain and email and it produces a board-ready report scoring nine risk dimensions — external exposure, attack surface, vulnerabilities, dark web, identity, cloud, program maturity, SOC readiness, and AI readiness — with OWASP mapping and a likely attack path.

Question 29

What is Firehose?

Accepted Answer

Firehose is a synthetic event load generator and SIEM stress-tester for Wazuh. It pushes high-volume TCP syslog across realistic attack scenarios, reads the alerts back, and measures real ingest throughput (events per second) and detection latency (MTTD p50/p95/p99) per run.

Question 30

Is Firehose's 'Adaptive' mode powered by AI?

Accepted Answer

No. Adaptive mode is a statistical simulator using Markov-style scenario transitions, a small consistent attacker pool, and a severity ramp. It is deliberately not an LLM and is not trained on your data.

Question 31

How is Jutsu priced?

Accepted Answer

Jutsu offers Free, Startup, Business, and Enterprise/MSSP plans. The first 5 assets are always free, the Startup plan is priced per asset, and Business and Enterprise are custom-quoted to your environment, asset volume, and compliance needs.

Question 32

Can I try Jutsu before committing?

Accepted Answer

Yes. Start on the Free plan with no credit card, or run the free Exposure external assessment in minutes. You can also join the Design Partner Program to evaluate the platform in your own environment.

Question 33

How does multi-channel alerting and reporting work?

Accepted Answer

Notifications can be delivered via Email (SendGrid), Slack, Telegram, and PagerDuty. Incident reports are generated as Markdown and stored in S3, and an organization-reporting job produces weekly or daily SOC activity reports with MTTD/MTTR/MTTA metrics, rendered to HTML or PDF.

Question 34

What kind of organizations is Jutsu built for?

Accepted Answer

Early-stage startups can start free, growing startups use the Startup plan for 24/7 coverage without a SOC team, mid-market and regulated companies move to Business for compliance and multi-user access, and enterprises and MSSPs use the Enterprise plan for multi-tenant management and private deployment.

Question 35

Do I need a dedicated SOC team to use Jutsu?

Accepted Answer

No. The platform is designed to give startups 24/7 autonomous coverage without standing up a SOC team. The AI agents handle triage, enrichment, and containment, and only escalate to a human when judgment is genuinely needed.

Question 36

Is there an audit trail of everything that happens?

Accepted Answer

Yes. Webhook receipts, worker processing, and API mutations are written to a PostgreSQL audit log, logins are audited with IP, and Red Team additionally keeps an append-only, SHA-256 hash-chained audit log with a verify endpoint that detects tampering.

Frequently asked questions

Platform & Product

AI Agents & Automation

Security & Data

Deployment & Integrations

Red Team, Exposure & Firehose

Getting Started & Plans

Still have questions?