Mechanic AI
A retrieval-augmented troubleshooting assistant that gives heavy-equipment mechanics cited, step-by-step diagnostics. Numeric specifications can come only from a human-verified fact registry, and a deterministic, fail-closed output check blocks unverified values instead of trusting the model. Releases must pass adversarial-safety and fact-authority gates in CI.
AI Abuse Detections
Sigma rules for AI and LLM abuse, including LLMjacking, AI API key misuse, shadow AI, and agent or MCP configuration tampering, mapped to MITRE ATT&CK and MITRE ATLAS. No rule merges unless it passes CI tests against positive and negative logs.
LLM Alert Triage Eval
LLM-assisted SIEM alert triage measured against a rules baseline on public labeled alert data, with the false-negative rate as the headline metric. It also tests whether prompt injection hidden in alert fields can change the model's decision.