Ekos Cyber Labs

Project Corvus is an on-prem AI SOC analyst for small teams that run Wazuh, have no 24/7 SOC, and cannot ship their logs to a vendor's cloud. It came from our own need: we are a small team protecting a brand-protection platform without a 24/7 SOC, so we built the analyst we wanted watching our own Wazuh. The concept predates the event; all the code in the repository was written since Oct 26, 2026. It plugs into the Wazuh the team already has. Windows/Sysmon and Linux alerts and archives are normalized to OCSF 1.9.0 and correlated deterministically (host, user, IP, process, time) into incidents mapped to MITRE ATT&CK, with an explainable severity floor no model can lower. Muse Glimmer, on our own NVIDIA DGX Spark, triages every cluster on-prem, so raw logs never leave the network. Only condensed, pseudonymized incidents go to Muse Spark, which rebuilds the attack chain, writes the timeline and a response plan in English or Spanish, and pulls evidence through two read-only tools. When an attack was missed, Corvus drafts a Sigma rule and backtests it; once a human approves, it runs in shadow mode, where it can only tag alerts. Exporting to Wazuh stays a separate, human-run step. Measured (committed reports, n stated): on the public APT29 day-1 dataset (196,081 records) incidents cover 8 of 10 steps of the known chain; 53 of 110 atomic tests yield an incident with the right technique; a synthetic benign day (312 records) gives 4 incidents, none Critical or above. Glimmer's first-pass JSON validity is 0.8839 (112 calls); one Spark analysis costs about USD 0.044 (n=5). On 62 synthetic adversarial incidents (57 prompt-injection variants), no attack flipped a verdict, leaked data, or took a tool call out of scope; the model's own run-to-run variation (21 of 25 correct on clean twins) exceeds any effect we can separate. Honest limits: non-service usernames can join incidents across hosts; the pseudonymizer cannot hide what has no recognizable shape; the UI has no login; rule export does not yet work for rules learned from live indexer incidents; and the learned-rule loop was shown on one step (1 of 8 on an unseen variant, n=1). More in the README. AGPL-3.0.