Skip to content
Operator documentation for the SecOpsAI platform

Operate SecOpsAI from sensor deployment to published research.

Deploy Edge sensors, monitor network and package-registry changes, investigate findings, manage evidence and disclosure, and produce reports without giving up control of raw telemetry.

Get Started SecOpsAI Edge Research Platform
Edge sensors Asset discovery Package surveillance Findings and triage Research cases Reports
docs.secopsai.dev 
$ secopsai edge sync
[OK] Edge assets and findings imported
[OK] asset graph updated

$ secopsai research monitor run-due
[OK] registry monitors completed

$ secopsai triage list --source secopsai_edge
REVIEW 2 findings require operator action

Manifesto

SecOpsAI connects network discovery, software supply-chain monitoring, host and agent telemetry, findings triage, research evidence, and reporting. These documents follow the same operating sequence from collection and detection through investigation, remediation, disclosure, and publication.

Core guides

Follow the product workflow in operating order.

Start with deployment and data collection. Continue through findings, research, and reporting. Use the reference material when you integrate or scale the platform.

Guide 01

Getting Started

Install SecOpsAI, activate the virtual environment, and run the first local pipeline.

Guide 02

SecOpsAI Edge

Register a sensor, discover authorized networks, synchronize the asset graph, and operate scheduled scans safely.

Guide 03

Findings Triage

Review evidence, assign status and disposition, record notes, and verify remediation with a repeatable analyst workflow.

Guide 04

Research Discovery

Configure cross-ecosystem watchlists, registry monitors, candidate scoring, package comparison, and campaign correlation.

Guide 05

Research Cases

Manage evidence, IOCs, verdicts, sandbox approval, responsible disclosure, publication safety, and case monitoring.

Guide 06

Deployment Guide

Choose local, sensor, hosted-pilot, and service-provider deployment patterns with clear security boundaries.

Capabilities

Documentation for each operating surface.

The information architecture follows product ownership: collection, investigation, research, response, publication, and deployment.

Quick Start

Deploy in minutes.

Install Core, collect local telemetry, correlate findings, and open the operator workflow from one command sequence.

bash 
# Install and initialize
curl -fsSL https://secopsai.dev/install.sh | bash
cd ~/secopsai
source .venv/bin/activate
secopsai refresh
secopsai refresh --platform macos,openclaw,hermes
secopsai correlate
secopsai triage orchestrate --search-root ~/secopsai
Available

SecOpsAI Core

Canonical findings, graph, triage, research, correlation, and reporting store.

Available

SecOpsAI Edge

Authorized asset discovery, service exposure, Wi-Fi inventory, and sensor jobs.

Available

SecOpsAI Research

Registry monitoring, candidate scoring, evidence, disclosure, and publication gates.

Available

OpenClaw

Local automation bridge for approved Core and Edge operator actions.

Beta

Host adapters

macOS, Linux, Windows, and Hermes telemetry adapters with platform-specific coverage.

Contact

Reach the SecOpsAI team.

Use the right channel for security reports, independent research, disclosure coordination, or research collaboration.

Security

Report a security issue

Send vulnerability reports, suspected abuse, and security-sensitive disclosures.

security@secopsai.dev Research

Contact research

Share independent research, package intelligence, collaboration ideas, or pilot questions.

research@secopsai.dev