Close with evidence
An alert shown to be a known issue or a false positive is closed in the SOAR, with its reasoning written as a comment.
SOC Mastermind · System3
Closes the alerts you already know. Leaves the doubtful ones to you.
SOC Mastermind is a SOC assistant that runs next to your SOAR. It closes recurring false positives with evidence and a written reason, and routes every alert with weak evidence to an analyst.
Where would you like to start?
For CISOs and SOC managers
See where automation stops, how every decision is audited and how you turn it on step by step.
Security and dataFor SOC analysts
See the evidence behind every closure on one screen, and confirm or reopen it in seconds.
The analyst view
The problem
Most alerts are not new.
The same maintenance job, the same scanner, the same misconfiguration raise alerts again every day. Closing them one by one fills an analyst's day while the alert that matters waits in the queue.
Recurring false positives
The alert closed yesterday comes back today. The knowledge stays in an analyst's head and never reaches the system.
Lost reasoning
Why an alert was closed is often not written down, so every shift asks the same question again.
Alert fatigue
The more noise there is, the easier it becomes to miss the real signal.
The approach
Two outcomes. No third option.
Every alert gets one question: can we show, with evidence, that it is safe to close?
When in doubt, a human decides
If the evidence falls short, or an error or timeout occurs, the alert goes to an analyst. This is the default.
How it works
Pull, evaluate, decide, learn.
SOC Mastermind runs on the machine where your SOAR is installed and pulls alerts from the SOAR API.
Pull
The alert is taken from the SOAR. The system talks only to the SOAR and connects to nothing else.
Evaluate
It checks whether there is enough evidence to show the alert is safe to close.
Decide
With enough evidence, CLOSE; otherwise, ESCALATE. Every decision is recorded with its reasoning.
Learn
It benefits from your team's decisions, and that process stays under your control.
Trust principles
Safe first, then fast.
If a security product is going to make a mistake, it should make it on the safe side. Every part of the system is designed around that.
Doubt goes to a human
Insufficient evidence, an error or a timeout sends the alert to an analyst. Fail safe, never fail open.
No access
It never touches endpoints, the network or target systems, and never triggers playbooks. In the SOAR it can only close, comment and tag.
Observe first
The system first only observes and closes nothing. You decide when to turn automation on.
Auditable and reversible
Every decision is recorded with its reasoning. Closures can be reopened one by one or in bulk.
Kill switch
One action stops all automatic closing.
Your data stays yours
With a local model, data never leaves the machine. Installation without an internet connection is supported.
Product
The evidence behind every decision, in plain sight.
When an analyst checks a closure, the reasoning and the evidence are on one screen.
An honest start
It starts quiet and speaks up as it earns trust.
It closes nothing on day one. It begins in observe mode: it records the decision it would make and leaves the alert alone.
A product that wrongly closes an alert in a new customer's first week never gets installed again. That is why we start cautiously.
Targets
We state our targets openly.
The figures below are design targets, not measured results. Each installation measures them on your own data in observe mode.
target
≥ 99.7%
Auto-close precision target
The share of alerts the system marks CLOSE that should indeed be closed.
target
40–55%
Coverage target in a mature installation
The share of alerts that can be safely closed without reaching an analyst.
target
≤ 30 s
Decision time target (p95)
From receiving the alert to writing the decision.
target
≤ 30 s
Target time for an analyst to verify a decision
The evidence is on one screen; no searching required.
See it on your own alerts, in observe mode.
From day one the system shows what it would do without closing anything. You make the call.