SPECTREIQ

The AI-native SOC operating system.

[ OK ] An interactive console for hands-on security practitioners.

[ OK ] modules: review · triage · detect · recon · assess · history

[WARN] AI output is a draft. You validate before acting.

module osint/previewLIVE · AI-ASSISTED · PUBLIC DATA ONLY

Sent to the AI preview service. Public business info only; no credentials or personal data.

[*] Awaiting target. Example: a company name or example.com

Output is AI-generated and unverified. This is not a live scan.open full console >

siq > show modules

Loaded modules.

Every module maps to a real tool in the workspace. What you feed it, what comes back, and where it stops.

#NameInputOutputBoundary
0review/source_codeSource code review analysisUploaded source filesAI-identified weaknesses with locations, severity and remediation suggestionsReviews code you upload. Does not scan networks or hosts.
1triage/emailEmail analysis analysisRaw headers, URLs, attachment details, authentication resultsParsed SPF/DKIM/DMARC, extracted indicators, optional AI phishing assessmentWorks on what you paste. Does not connect to your mail system.
2detect/rule_draftDetection rule drafts draftingA plain-language description or explicit conditionsSigma, YARA or Snort rule drafts you can copy or downloadDrafts only. Not deployed or tested against your telemetry.
3recon/osint_reportOSINT reports reportingA target and the context of your engagementA structured, AI-assisted report of angles and leads to pursueNot verified collection. Treat content as leads to confirm.
4assess/off_def_reportAssessment reports reportingScope, environment and objectives for an assessmentStructured offensive or defensive assessment write-upsPlanning and reporting aid. You own execution and authorisation.
5post/report_historyReport history recordsNothing extra; analyses are saved as you workFilterable history of past reports, downloadable as textKeeps your output in one place for review and hand-off.

siq > cat examples/*.log

Sample sessions.

Static, illustrative data. Switch tabs to compare what goes in with what a module returns.

Illustrative example, static content
INPUTpasted_headers.eml
01Return-Path: <billing@invoice.example>
02From: "Accounts Payable" <ap@company.example>
03Reply-To: ap-desk@invoice.example
04Subject: Overdue remittance - action required
05Authentication-Results: mx.company.example;
06  spf=fail smtp.mailfrom=invoice.example;
07  dkim=none; dmarc=fail header.from=company.example
08Received: from mail.invoice.example (192.0.2.47)
09 
10Body: https://portal.example/remit?id=4471
11Attachment: Remittance_0419.html
OUTPUTPhishing analyzer
SPFfail sending host not authorised by envelope domain
DKIMnone no signature present
DMARCfail no passing, aligned SPF or DKIM result
MismatchReply-To differs from From
URLportal.example/remit
FileRemittance_0419.html (HTML attachment)
AssessmentLikely spoofed invoice lure. High concern.
Check nextLook up URL reputation; search mailbox for same Reply-To; confirm with AP by phone.

Header, URL and authentication fields are parsed from what you paste. The phishing assessment is an optional AI step. Human validation is required before acting.

siq > help workflow

load. run. check. save.

  1. 01 load

    Bring the material

    Paste headers, upload a file, describe a detection, or define an assessment scope.

  2. 02 run

    Review the analysis

    Examine the findings, extracted indicators or rule draft in the relevant module.

  3. 03 check

    Validate and decide

    Confirm findings against your own tools and data before they go anywhere.

  4. 04 save

    Retain the report

    Saved to history. Filter later, download as text for tickets or clients.

siq > info --limits

Analysis support. Not autonomous operations.

AI output can be wrong or incomplete. SpectreIQ speeds up analysis and write-up, with a qualified person checking the result.

does
Review uploaded code, parse pasted email artefacts, draft detection rules, structure OSINT and assessment reports, keep a searchable history.
does_not
Scan networks, monitor endpoints, execute commands, collect or verify OSINT data, deploy or test rules, or take response actions automatically.
requires
Your judgement, your validation against real telemetry, and authorisation for any activity against a target.

siq > exit

Or don't. Start with the material already on your desk.

View pricing