gsage is an on-premise Security Operations Center (SOC) assistant that integrates AI agents, structured tooling, and human oversight to enhance security teams' efficiency. By enabling monitoring, investigation, triage, and response within an organization's infrastructure, gsage eliminates the need to rely on third-party SaaS solutions, ensuring data remains secure and operations are auditable.
Key Features and Functionality:
- AI-Driven Orchestration: Utilizes AI agents with scoped tool access, operating within a FastAPI backend, Celery workers, and RedBeat scheduler. This setup ensures logged, audited, and isolated operations through an MCP server with per-organization, department, and user permissions.
- Comprehensive Integrations: Seamlessly connects with existing tools such as antivirus programs, Endpoint Detection and Response (EDR) systems, Security Information and Event Management (SIEM) platforms, ticketing systems, Web Application Firewalls (WAF), proxies, Human Resources (HR) systems, Active Directory, and asset inventories. These integrations are exposed as typed tools that can be combined, scheduled, and governed with rules.
- On-Premise Control: Operates entirely within the user's environment, supporting multi-tenant configurations with organizations, departments, and users as core primitives. Every execution is logged in Elasticsearch, ensuring a full audit trail without data leaving the premises.
- Versatile Entry Points: Accessible through various interfaces, including a React-based web UI, email, Telegram, and Command Line Interface (CLI), allowing teams to interact with gsage in their preferred workflows.
Primary Value and Problem Solved:
gsage addresses the inefficiencies in traditional SOC operations by reducing the time security teams spend switching between dashboards, performing repetitive checks, and manually gathering context for decision-making. By automating these processes and integrating with existing tools, gsage enhances operational efficiency and security posture. Its on-premise deployment ensures that sensitive data remains within the organization's control, providing a secure and auditable solution for modern SOC needs.
