Aeion Neural Bus for Security Incident Response
Security teams spend most of their day reading dashboards, not stopping attacks. Neural Bus turns the read-and-react pattern into detect-and-remediate. The rule-based Event Correlator catches ~90% of known attack patterns in milliseconds with zero AI calls; the Pattern Detector routes novel sequences through an SLM for shape analysis; the Remediation Generator dispatches the response (IP block, account suspend, and other MCP tool actions) per your auto-execute policy. Your on-call still gets paged for high-severity decisions — but most of the routine attack response happens before the page lands.
The Operating Model
Traditional security stacks layer detection on top of logs ("SIEM" — Splunk, ELK, Sumo) and let humans + ticket queues decide what to do. The pattern is: log → ingest → query → alert → human-triage → escalate → action. The "log → action" gap is typically 5-30 minutes for routine incidents, hours for novel ones.
Attack Pattern 1 — Credential Stuffing
`
Attack Pattern 2 — Content Scraping
`
Attack Pattern 3 — Distributed Account-Takeover Attempt
`
Attack Pattern 4 — API Abuse (Token Theft)
`
The Approval-Required Path
`
What Neural Bus Does NOT Do
Being honest:
FAQ
Rule-based detection + auto-execute: well under 100ms for the routine cases (per the platform's MCP tool-dispatch budget). SLM-routed analysis adds up to ~500ms. Approval-required remediations are paced by human approval (typically 1-30 minutes).
Tunable per-pattern. Most tenants start with auto-execute disabled for the first month while observing patterns and tuning rules; gradually expand auto-execute as confidence builds. Severity classification + blast-radius estimates make this safer.
Possible in worst cases. Mitigations: (1) auto-execute thresholds tuned conservatively, (2) time-boxed rate-limit used before a full block in ambiguous cases, (3) one-click admin override on the block, (4) end-user "release my block" self-service link in some patterns.
SIEM stores and queries logs; Neural Bus reacts in real-time. SIEM is great for "show me last quarter's attacks"; Neural Bus is great for "stop this attack now." Often used together.
Yes. Severity-classified remediation outputs route via webhook. Neural Bus's value is the _action_; on-call rotation handles the _follow-up_.
Yes — Event Correlator runs entirely on rules. ~90% of routine patterns don't need AI inference. The Pattern Detector + SLM path is for novel/ambiguous shapes; you can disable AI routing entirely if you prefer rule-only.
~$50-200/month AI inference for moderate-volume tenants (a few thousand events / hour). High-volume tenants tune the rule layer to absorb more, keeping AI cost flat as event volume grows.
Volumetric DDoS is a Sentinel / network-layer concern, not Neural Bus. Application-layer DDoS (HTTP flood, slowloris) — yes, Neural Bus can detect patterns and route to Sentinel for rate-limit.
Declarative format. Events × time-window × per-key correlation × threshold conditions. Boolean composition of these is supported. For more complex logic (Bayesian, ML), use Pattern Detector with custom SLM prompts.
Every detection + every remediation logged with full payload + reasoning + identifier. Pluggable into SOC 2 / ISO 27001 / GDPR evidence pipelines.