Current scope
Snapshot analysis, not continuous monitoring or enforcement. It does not confirm exfiltration. Published evaluations use synthetic data, not production performance guarantees.
MIT
Read the evidenceAI Secure.
From scattered alerts to one reviewable case.
Connect exposure, privileged access, and file activity. Keep observations, hypotheses, and unknowns distinct as you investigate.
What it does
- Logs
- correlation
- review
(03) AI Secure — Film
(+) In detail
04 / SECURITY & INVESTIGATION / Research prototype
Trace security signals through the logs
What happened before this alert?
A change in exposure. A privileged login. Access to a file. Follow separate signals through one investigation, keeping what you know distinct from what you suspect.
The first button opens a browser demo on synthetic data. It does not connect to live monitoring or enforcement.
FIRST THING TO TRYUse synthetic logs to see observations, hypotheses and unknowns separated in one case.
Setup, scope & license
MIT · Snapshot analysis, not continuous monitoring or enforcement. It does not confirm exfiltration. Published evaluations use synthetic data, not production performance guarantees.
WHAT THE FILM SHOWS
One alert is a starting point.
Observe
Collect exposure, privileged access and file-activity signals.
Correlate
Connect related evidence into one case instead of reading alerts in isolation.
Separate judgment
Keep observed facts, hypotheses and unknowns explicitly distinct.
TRY IT
Three signals. Somewhere to start.
The public demo is snapshot analysis on synthetic data. It demonstrates how observations, hypotheses and unknowns stay distinct; it is not continuous monitoring or enforcement.
CURRENT BOUNDARIES
Availability and development.
Proposed interface design
The separate design film is a proposal for a future interface. It is not a demonstration of the current product or proof that the proposed UI has shipped.
Open the labelled design study(05) What it can do
A local prototype for following the evidence.
Source: Check the README · checked against the repository on 2026-09-27 (357abc6)
Scattered alerts into one case
One rule links exposure, privileged login and large sensitive-file access. The published comparison runs on synthetic logs and is not a production performance guarantee.
Observed, hypothesis, unknown
Every finding carries the event IDs it was built from and keeps observed facts, inferred hypotheses and unknowns as separate states.
Analysis without egress
The demo and analysis paths run locally and offline with no account and no telemetry. Only the optional execute and Okta-watch paths send data, and only to the endpoints you configure.
(06) Scope and evidence
What it cannot do,
stated up front.
Public sources checked 2026-09-15. Check each repository and product page for current terms.
SCOPE
Snapshot analysis, not continuous monitoring or enforcement. It does not confirm exfiltration. Published evaluations use synthetic data, not production performance guarantees.
PROOF / PUBLISHED EVIDENCE
An interactive synthetic case and reproducible single-rule versus correlation evaluation.
(07) Build with it