Red TeamCloud response drills with AI-guided, human-confirmed actions
The product at red.agentsoc.com is built from the open agentsoc-actions-runtime stack: an AI SOAR assistant (AgentSOAR) that maps live inventory and stages defensive mutations across major clouds—nothing applies until you confirm.
AWS, GCP, and Azure
One assistant reasons over the provider you connect—inventory and mutations follow the same staged, confirmable pattern per cloud.
Grounded in inventory
List and resolve resources before any change. Organization credentials can sync inventory into persistence so proposals only target resources you actually run.
Human in the loop
Quarantine, block-IP, and power operations are staged first; the runtime applies them only after you confirm the returned token—no silent automation.
Purple-team ready
Use controlled mutations to exercise detections, runbooks, and analyst muscle memory in environments you own—without pretending to be unsanctioned offensive tooling.
How actions are staged
The backend assistant exposes tools such as list_inventory, lookup_resource, propose_quarantine, propose_block_ip, propose_set_power, and execute_confirmed_mutation. Proposals return a confirmation token; execution runs only after you clearly approve—matching production-safe SOAR patterns.
What powers red.agentsoc.com
Backend + frontend apps
Red Team at red.agentsoc.com is served from the actions-runtime monorepo. Per AGENTS.md: a Hono API (MongoDB-backed org credentials, inventory sync, SOAR chat streaming) and a React SPA that proxies to it—designed for serious automation, not toy demos.
- Provider-specific quarantine, subnet NACL / firewall-style IP blocks, and instance power controls where supported
- Sessions can bind to saved organization credentials so proposals align with synced inventory
- Assistant prompts forbid echoing secrets and spell out when to propose vs. execute
Works with the AgentSOC platform
Ingestion, enrichment, and case management live on AgentSOC Platform; this runtime focuses on cloud-side response motions you can rehearse and operationalize with guardrails.
Plan a red-team or purple-team rollout?
We will walk through scope, cloud connectivity, and how confirmation gates should map to your change-management policy.