Defensive security analytics · research platform

See the whole picture.
Decide with a human.

Omniculus fuses your security telemetry into a living knowledge graph, surfaces dangerous activity with explainable detections, and routes every consequential call to a person. Powerful sight — accountable decisions.

omniculus — run_demo.py
[ingest]  322 events generated · synthetic lab data
[graph]   19 entities · 322 observations fused
[detect]  22 alerts above confidence floor
 
#1 [CRITICAL] brute_force → host-04 (HUMAN REVIEW)
#7 [HIGH]     lateral_movement · user-06 → 6 hosts
#14 [HIGH]    known_bad_contact · host-05
 
[feedback] threshold retuned · precision-driven, logged
→ no actions executed. a human decides.
The Platform

One pipeline, five stages

Every stage is explainable and inspectable. Data you're authorized to use goes in; ranked, evidence-backed recommendations come out.

01

Ingest

Synthetic generator by default, plus authorization-gated connectors and public threat-intel feeds.

02

Fuse

Entities and observations woven into a knowledge graph — the substrate for correlation and attack-path analysis.

03

Detect

Explainable rules and statistical anomalies. Every alert carries the rule that fired and its evidence.

04

Investigate

Alerts ranked and routed. Consequential findings require human review. Nothing is auto-executed.

05

Learn

Analyst dispositions retune detection thresholds — bounded, logged, and auditable. Vigilance without black boxes.

How it works

From raw telemetry to an accountable call

The feedback loop closes back onto detection — the system grows more vigilant over time while staying explainable.

INGEST

Collect

authorized + synthetic

GRAPH

Fuse

knowledge graph

DETECT

Surface

explainable alerts

INVESTIGATE

Decide

human-in-the-loop

FEEDBACK

Adapt

retune & loop back

Principles

The boundary is the product

Omniculus is built to be powerful and responsible by design. These constraints aren't disclaimers — they're encoded in the architecture.

Human-in-the-loop

The system recommends and explains; a person decides and acts. There is intentionally no response-execution module.

Synthetic-first

Developed and validated on generated data and lab replicas — never pointed at infrastructure you don't own.

Explainable & auditable

Every alert references its rule and evidence. Every learned change is logged with the precision that justified it.

Data minimization

A core research question: how little can we collect and still answer the security question?

What Omniculus is not

  • Not mass surveillance. Authorized, synthetic, and lab data only — never people you have no authority over.
  • Not an autonomous actuator. No module executes a response; consequential calls route to a human.
  • Not a production weapon. No targeting of infrastructure the operator doesn't own or isn't authorized to test.
Roadmap

Where Omniculus is going

PHASE 0 · SHIPPED

Foundation

Synthetic data, knowledge-graph core, four explainable detections, human-in-the-loop decision support, and the feedback loop — running end to end.

PHASE 1

Detection quality

Alert correlation & dedup, per-entity behavioral baselines, and an evaluation harness for precision / recall / time-to-detect.

PHASE 2

Graph analytics

Attack-path discovery, centrality and community detection, and a temporal view of the evolving attack graph.

PHASE 3

ML & game theory

Anomaly models plus a Stackelberg / SUQR allocator that focuses limited analyst attention against an adaptive adversary.

PHASE 4–6

Realistic data, scale & product

Public-dataset replay and adversary emulation, an optional Neo4j backend and investigation UI, and the omniculus.com public sandbox.

Get started

Spin it up in a minute

Clone, install, and run the full pipeline on synthetic data — no sensitive data, no setup beyond Python.

quickstart
python -m venv .venv && source .venv/bin/activate
pip install -r requirements.txt
python scripts/run_demo.py