Omniculus — Idea Backlog

Unsorted ideas captured from discussion. Not commitments — a place to think. Promote items into ROADMAP.md when they're ready.

Detection & analytics

• Sigma rule import so community detections drop in directly.
• MITRE ATT&CK technique tagging on every alert; coverage heatmap of which techniques we can/can't detect.
• Sequence/sessionization: group raw events into attack "stories" before alerting (reduces noise, improves the analyst narrative).
• Confidence calibration: are 0.8-confidence alerts right ~80% of the time?

Data & privacy research

• Data-minimization study: for each detection, how little data does it actually need? Quantify the privacy/efficacy trade-off. (Core research thread.)
• Differential privacy on aggregate analytics.
• Federated detection across simulated tenants without sharing raw data.
• Synthetic data realism: validate that detections trained on synthetic data transfer to public datasets (sim-to-real gap).

Decision support & responsible AI

• Contestability: every automated recommendation has an "appeal/override" path, logged.
• Bias/over-reach probes: a red-team harness that checks whether the system unfairly concentrates suspicion. Ties to the "teach the AI to be responsible" goal.
• Explanation quality: A/B different alert explanations on analyst speed.
• "Refuse to recommend" when uncertainty is high, rather than guessing.

Platform & ops

• Streaming/incremental graph updates (Phase 5).
• Neo4j backend behind the existing query helpers.
• Plugin system for detections (entry-points) so third parties contribute.
• Replay/time-travel: rewind the graph to any timestamp for investigation.

Product / omniculus.com

• Public, sandboxed demo running on synthetic data only.
• Decide open-source posture (e.g. permissive core + research notebooks).
• Clear, prominent "responsible use" / scope statement on the site — the boundary is a feature, say so publicly.
• Docs site generated from docs/.

Research questions worth a writeup

• Does auditable, bounded threshold-learning beat black-box retraining on precision and trust?
• Can the game-theoretic allocator measurably beat uniform monitoring under a learning attacker (the exploitability gap)?
• How early in an attack chain can graph-path analysis flag intent?