Security Operations
as Code
Stop Triage. Start Programming. A distributed intelligence architecture that unifies detection, AI governance, automated response, and edge enforcement into one programmable security fabric.
Deploy in your environment — free & open.
The Body
Detection Library
Version-controlled rules for Splunk, Sentinel & CrowdStrike
The Brain
AI Governance
Claude Security AI with Policy-as-Code enforcement
The Purpose
CLAW Engine
Continuous, Logic-Adaptive Workflows for automated response
The Nervous System
Edge Enforcement
HMAC-signed distributed enforcement at the edge
Detection to Enforcement in Seconds
From the moment a threat is detected to the instant it is contained — fully automated, fully audited.
The Body
Detects AitM phishing via Splunk correlation rule
The Brain
Claude AI evaluates threat confidence at 97%
The Purpose
CLAW engine executes revoke-sessions playbook
The Nervous System
Edge nodes enforce session block globally
Open by design. Deployable by anyone.
Every detection, playbook, policy, and lab scenario is versioned, peer-reviewed, and free. GitHub is the source of truth. The portal is the front door.
Detections-as-Code
Splunk · Sentinel · CrowdStrike
Playbooks-as-Code
CLAW YAML format
Policies-as-Code
AI governance rules
Labs-as-Code
Reproducible simulations
Choose your track
SOaC delivers differentiated value to every role in the security organization.
Threat Landscape Coverage
SOaC defends against the most active threat actors and techniques mapped to the MITRE ATT&CK framework. Click any threat to see the matching package.