Does security telemetry leave my environment?

No. SynapCores is self-hosted with local model inference — embeddings, anomaly models, and agent reasoning all run inside your environment. Logs, IOCs, and case data never transit a third-party API. That is the point: a security data layer you can put anywhere, including air-gapped, with one docker compose.

How is this different from a SIEM or a graph database?

A SIEM stores and rules; a graph database traverses; a vector store does similarity; an ML platform detects anomalies — you normally stitch four systems together. SynapCores is one engine that does property-graph traversal for attack paths, vector similarity for threat-intel correlation, in-database anomaly detection, agentic enrichment, and a write-once immutable audit — over the same data, in SQL and Cypher. Fewer copies, fewer boundaries, one query surface.

Can I keep an auditable record of what the automation did?

Yes. Every enrichment, every agent action, and every proposed response writes to a cryptographically hash-chained immutable table, so you get a write-once, append-only record of input, tool calls, and action — the audit posture modern agentic-SOC guidance calls for, stored inside the engine rather than trusting the automation platform to be honest about itself. VERIFY TABLE proves it was not altered.

Self-hosted threat intelligence & detection

Correlate IOCs on a property graph, hunt anomalies with in-database ML, and enrich alerts with an agent — self-hosted, so security telemetry never leaves. Graph, vectors, anomaly detection, and a write-once action audit in one engine. docker compose up and hunt.

Self-host it — free Star on GitHub See it run

Need it for a team or air-gapped rollout? Talk to us.

The pain we built this for

If you do detection engineering or threat intel, you know the seams: “My IOCs are in one tool, my graph in another, my anomaly models in a notebook, my case audit in a wiki — and I can’t send any of it to a cloud AI. Correlating a fresh alert against everything I know is a manual afternoon.”

Attack-path questions ("what does this compromised host reach?") are recursive graph traversals your SIEM query language fights you on.
Correlating a new indicator against past incidents is keyword search when it should be similarity search — you miss the near-matches.
Anomaly models live outside the data, so scoring means an export, a pipeline, and a lag.
Agentic response is arriving, but non-deterministic automation with no tamper-evident audit is a liability, not a capability.
And none of it can go to a third-party AI API — security telemetry has to stay inside your walls.

See it — attack path + a tamper-proof action log

One graph query for blast radius, one immutable table for the action audit. This is the whole idea in a few statements.

-- Correlate an IOC across your graph: what does this hash touch?
CYPHER
MATCH (i:Indicator {sha256: $hash})-[:SEEN_ON]->(h:Host)
MATCH path = (h)-[:CONNECTS_TO|AUTH_TO*1..4]->(crown:Asset {tier: 'crown-jewel'})
RETURN path;                          -- attack path to what matters, in one hop-query

-- Every automated action lands on a write-once, tamper-evident ledger.
CREATE IMMUTABLE TABLE soc_actions (
  alert_id  TEXT,
  actor     TEXT,               -- which agent / analyst
  tool      TEXT,               -- what it called
  input     JSONB,
  action    TEXT,               -- proposed / taken
  ts        TIMESTAMP DEFAULT now()
);

-- Prove the action log was never rewritten.
VERIFY TABLE soc_actions;

Six security capabilities. One self-hosted engine.

Graph for attack paths, vectors for correlation, ML for anomalies, agents for enrichment, immutable tables for the audit — over the same data, no stitching.

IOC & attack-path correlation on a graph

Model assets, identities, indicators, and TTPs as a property graph and traverse blast-radius / attack-path in a single Cypher query — recursive traversal that a JOIN-heavy SIEM query cannot express cleanly.

Property graph · Cypher · GraphRAG

Anomaly hunting with in-database ML

Train and score anomaly models on logs, auth events, and telemetry directly in SQL — 3-sigma latency spikes, account-takeover patterns, sensor drift — no export to a separate ML platform.

AutoML · anomaly detection · SQL

Threat-intel correlation by meaning

Embed advisories, reports, and past incidents and retrieve the semantically nearest prior art for a fresh alert — correlation that keyword rules miss.

Vector search · EMBED · RAG

Agentic alert triage & enrichment

An agent triages an alert, walks the graph for context, pulls similar prior incidents, and proposes a response — bounded by an allowlist, so it enriches and recommends without acting blind.

CREATE AGENT · tools · allowlist

Write-once action audit

Every automated step writes to a hash-chained immutable table — a write-once, append-only record of input, tool calls, and action, stored in the engine, not in the automation platform that produced it. VERIFY TABLE proves integrity.

CREATE IMMUTABLE TABLE · VERIFY TABLE

Entity & identity resolution

Resolve the same actor across usernames, hosts, and indicators with vector similarity plus graph relationships — collapse the noise into one entity before you page a human.

Vector similarity · graph

The objections that come up first

Data residency & air-gap

Self-hosted with local inference — runs on your infra or fully air-gapped. Telemetry never leaves; there is no third-party AI endpoint in the path.

Footprint & deploy

One docker compose brings up graph + vectors + anomaly ML + the audit ledger. Vector/graph/ML fit a modest box; the reasoning model can be local or an endpoint you control.

Trust the automation

Agents run behind an allowlist and write a tamper-evident record of everything they touch. You get auditable automation, not a black box that silently fails.

Fits your stack

Ingest from your SIEM, EDR, and log pipeline via API/streaming; query in SQL and Cypher; connect BI or notebooks over the MySQL wire protocol. It augments, it does not replace.

Run it yourself — the security recipe library

Every capability above is a runnable recipe — graph correlation, anomaly scoring, agentic triage, immutable audit. Certified against the latest release.

Attack-path analysis

What can a compromised host reach? One graph query

IOC semantic correlation

Match a new alert to prior incidents by meaning

Write-once action audit

Append-only, tamper-evident SOC action ledger

Entity resolution

Collapse one actor across usernames and hosts

Ring detection

Find the cluster, not the single node

Browse the full recipe library →

Every recipe is runnable, certified on the latest release

Why one engine beats four tools

The graph, the vectors, the anomaly models, and the audit ledger share one store — correlation is a query, not an ETL job across four systems.
No telemetry crossing a boundary to a cloud model or a hosted vector store — one deployment, one security review, air-gap-friendly.
Recipes are SQL and Cypher you can read and adapt — auditable automation, not an opaque service.

5-email course · free

Ship an agent with persistent memory in 5 emails

A 5-email course where you build a real agent with persistent memory — one runnable SQL recipe per email, no LangChain, no Pinecone, no Redis. Lesson 1 hits your inbox the second you sign up. After that: a new recipe every Monday. No spam.

Free forever. We'll never share your email.

Your security data layer, self-hosted

Graph correlation, in-DB anomaly detection, agentic enrichment, and a write-once action audit — one engine, on your infra. Pull it and hunt.

Self-host it — free Talk to us