# Ekos Cyber Labs

- **Event:** [Meta Global AI Developer Hackathon](https://cerebralvalley.ai/e/meta-ai-developer-hackathon)
- **When:** Oct 26, 12:00 PM – Nov 4, 9:00 PM (EST)
- **Where:** Online
- **Team:** [Eduardo Esteban Salmeron Jimenez](https://cerebralvalley.ai/u/eesalmeron)
- **GitHub:** https://github.com/Ekos-Cyber-Labs/Project-Corvus
- **Demo video:** https://youtu.be/QYu7uAKjTNo
- **Gallery:** https://cerebralvalley.ai/e/meta-ai-developer-hackathon/hackathon/gallery
- **Page:** https://cerebralvalley.ai/e/meta-ai-developer-hackathon/hackathon/gallery/3639

Project Corvus is an on-prem AI SOC analyst for small teams that run Wazuh, have no 24/7 SOC, and cannot ship their logs to a vendor's cloud.

It came from our own need: we are a small team protecting a brand-protection platform without a 24/7 SOC, so we built the analyst we wanted watching our own Wazuh. The concept predates the event; all the code in the repository was written since Oct 26, 2026.

It plugs into the Wazuh the team already has. Windows/Sysmon and Linux alerts and archives are normalized to OCSF 1.9.0 and correlated deterministically (host, user, IP, process, time) into incidents mapped to MITRE ATT&CK, with an explainable severity floor no model can lower. Muse Glimmer, on our own NVIDIA DGX Spark, triages every cluster on-prem, so raw logs never leave the network. Only condensed, pseudonymized incidents go to Muse Spark, which rebuilds the attack chain, writes the timeline and a response plan in English or Spanish, and pulls evidence through two read-only tools. When an attack was missed, Corvus drafts a Sigma rule and backtests it; once a human approves, it runs in shadow mode, where it can only tag alerts. Exporting to Wazuh stays a separate, human-run step.

Measured (committed reports, n stated): on the public APT29 day-1 dataset (196,081 records) incidents cover 8 of 10 steps of the known chain; 53 of 110 atomic tests yield an incident with the right technique; a synthetic benign day (312 records) gives 4 incidents, none Critical or above. Glimmer's first-pass JSON validity is 0.8839 (112 calls); one Spark analysis costs about USD 0.044 (n=5). On 62 synthetic adversarial incidents (57 prompt-injection variants), no attack flipped a verdict, leaked data, or took a tool call out of scope; the model's own run-to-run variation (21 of 25 correct on clean twins) exceeds any effect we can separate.

Honest limits: non-service usernames can join incidents across hosts; the pseudonymizer cannot hide what has no recognizable shape; the UI has no login; rule export does not yet work for rules learned from live indexer incidents; and the learned-rule loop was shown on one step (1 of 8 on an unseen variant, n=1). More in the README. AGPL-3.0.

## More from Meta Global AI Developer Hackathon

- [The Virtual Neuro Lab](https://cerebralvalley.ai/e/meta-ai-developer-hackathon/hackathon/gallery/3636)
- [DineTuned](https://cerebralvalley.ai/e/meta-ai-developer-hackathon/hackathon/gallery/3637)
- [Ereditas](https://cerebralvalley.ai/e/meta-ai-developer-hackathon/hackathon/gallery/3638)
- [ForgeFront Systems](https://cerebralvalley.ai/e/meta-ai-developer-hackathon/hackathon/gallery/3640)
- [CODECRAFT 3D](https://cerebralvalley.ai/e/meta-ai-developer-hackathon/hackathon/gallery/3641)
- [Yamcha](https://cerebralvalley.ai/e/meta-ai-developer-hackathon/hackathon/gallery/3642)

---

Markdown version of https://cerebralvalley.ai/e/meta-ai-developer-hackathon/hackathon/gallery/3639. Site index for agents: https://cerebralvalley.ai/llms.txt · full text: https://cerebralvalley.ai/llms-full.txt