SignalF0rge
A Python security analytics and investigation engine that normalizes telemetry, runs 24 native detections, correlates activity across sources, builds entity-centric cases, and exposes evidence through bounded read-only investigation tools.
The investigation layer can run deterministically or use an optional LLM as a planner. The model chooses from a strict read-only allowlist; it cannot execute shell commands, change detections, or override the deterministic severity and evidence. Prompt-injection defenses, bounded graph traversal, loop protection, and bounded per-entity case memory keep the agent constrained. A reproducible adversarial benchmark mixes 3,000 ordinary benign events, 19 legitimate attack-like events, and 21 labeled attack scenarios; the current baseline measures 79.49% precision, 100% recall, and 88.57% F1 while pinning 8 known false-positive cases in CI.