Web UI
React-based interface for analysts. Conversations, schedules, tool permissions, audit trail.
gsage is an on-premise SOC assistant that combines AI agents, structured tooling, and human review — so security teams can monitor, investigate, triage, and respond faster, without handing core workflows to a third-party SaaS.
gSage AI SOC is built on the gSage AI orchestration platform. This site is the source-available open edition; GuardianKey delivers the commercial Enterprise edition for organizations that need deployment, homologated integrations, support and SLA.
Security teams lose time switching between dashboards, repeating the same checks, and manually gathering context before they can make a decision. gsage reduces that friction while improving both operational efficiency and security.
FastAPI backend, Celery workers, RedBeat scheduler. Agents run with a clear execution model — logged, audited, and isolated through an MCP server with per-org/department/user permissions.
Antivirus, EDR, SIEM, ticketing, WAF, proxies, HR, Active Directory, asset inventory — exposed to the engine as typed tools you can combine, schedule, and govern with rules.
Runs in your environment. Organizations, departments, and users are core primitives. Every execution leaves a trail in Elasticsearch. Your data never has to leave.
gsage turns a natural-language question into a sequence of tool calls, enrichments, and actions — returning a summary you can audit.
gsage, search the environment for file hash abc123, gather antivirus update status from the affected machines, identify the associated users, open a ticket for each impacted host, add the hash to the blacklist, and email me the final status.
abc123 in the integrated SIEM / EDR (Bitdefender, CrowdStrike, Trellix)gsage, a user reported a suspicious email. Analyze the content, inspect links and attachments, and tell me whether it is phishing. If it is, create an incident ticket and send a summary for human review.
gsage, every day at 9:00 AM, search the environment for AnyDesk, TeamViewer and OpenVPN. For each host, tell me the machine name and the currently logged-in user.
React-based interface for analysts. Conversations, schedules, tool permissions, audit trail.
Send prompts, attach files, receive responses. Ideal for async analysis and paper-trail workflows.
On-call triage from your phone. Same permissions, same audit, without opening a laptop.
Terminal-first workflow with markdown rendering and conversation management. gsage ask "…"
Docker Compose is enough for the intended scale. Every service has a clear job, and the boundaries are the audit points.
LLM_PROVIDER.gsage ships with a growing catalogue of tools and makes it straightforward to add your own. Community-contributed tools live in guardiankey/gSage-soc-ai-tools.
Tools are BaseTool subclasses exposed through the MCP server. You define metadata, schemas, permissions, and execution logic; gsage handles registration, auditing, and orchestration.
Read the tool guide →from __future__ import annotations from typing import ClassVar, Optional from src.mcp_server.tools.base import BaseTool, ToolResult from src.shared.security.context import AgentContext class MyTool(BaseTool): """Short description used in MCP and admin metadata.""" name: ClassVar[str] = "my_tool" version: ClassVar[str] = "1.0.0" summary: ClassVar[str] = "One-line summary used by search_tools" category: ClassVar[str] = "utility" permissions: ClassVar[list[str]] = ["utility:run"] rate_limit_per_minute: ClassVar[int] = 30 timeout_seconds: ClassVar[int] = 15 use_circuit_breaker: ClassVar[bool] = False params_schema: ClassVar[dict] = {"type": "object", "properties": {"value": {"type": "string", "description": "Input value to process"}}, "required": ["value"], "additionalProperties": False} config_schema: ClassVar[Optional[dict]] = {"properties": {"prefix": {"type": "string", "description": "Optional prefix used in the output"}}, "required": []} config_defaults: ClassVar[dict] = {"prefix": ""} async def execute(self, agent_context: AgentContext, params: dict, config: dict, state: dict) -> ToolResult: raw_value = params.get("value") if not isinstance(raw_value, str) or not raw_value.strip(): return self._failure("INVALID_INPUT", "'value' must be a non-empty string") return self._success({"value": f"{config.get('prefix', '')}{raw_value.strip()}", "org_id": str(agent_context.org_id)})
gsage is proprietary but source-available. You can read the code, deploy it, and use it to defend your own organization — for free, within a few clear limits.
Clone, docker compose up, and start asking.