AI Motorları ve Otonomi Güvenlik Modeli — Trust Pro Cyber Defense

60 AI motoru birer bağımsız ticari ürün değil, SOC iş akışlarında kullanılan analiz fonksiyonlarıdır. Her motorun veri kaynağı, test kümesi, model sürümü, hata davranışı, insan onay sınırı ve kullanılabilirlik hedefi ayrı ele alınmalıdır.

#	Motor	Aile / alan
01	Alert deduplication	Triage & Korelasyon
02	Severity calibration	Triage & Korelasyon
03	Case similarity	Triage & Korelasyon
04	False-positive explanation	Triage & Korelasyon
05	SLA breach forecasting	Triage & Korelasyon
06	Escalation routing	Triage & Korelasyon
07	Hypothesis planning	Investigation
08	Event timeline summary	Investigation
09	Attack path linking	Investigation
10	Evidence contradiction finder	Investigation
11	Identity-session correlation	Investigation
12	Source confidence estimator	Investigation
13	IOC enrichment	Threat Intelligence
14	Campaign clustering	Threat Intelligence
15	Threat report RAG	Threat Intelligence
16	Actor technique mapping	Threat Intelligence
17	IOC expiry scoring	Threat Intelligence
18	Retro-hunt query advisor	Threat Intelligence
19	Beacon anomaly	Endpoint & Network
20	Lateral movement scoring	Endpoint & Network
21	Process tree anomaly	Endpoint & Network
22	DNS novelty scoring	Endpoint & Network
23	EDR sensor health anomaly	Endpoint & Network
24	Network flow risk	Endpoint & Network
25	Account takeover likelihood	Identity & Insider
26	MFA fatigue detection	Identity & Insider
27	Privilege escalation signal	Identity & Insider
28	Service principal anomaly	Identity & Insider
29	Peer group behavior	Identity & Insider
30	Exfil outlier detection	Identity & Insider
31	Cloud IAM risk	Cloud & Workloads
32	Storage exposure correlation	Cloud & Workloads
33	Container runtime outlier	Cloud & Workloads
34	K8s audit anomaly	Cloud & Workloads
35	Cross-cloud identity graph	Cloud & Workloads
36	Serverless abnormality	Cloud & Workloads
37	Prioritized remediation	Exposure & Validation
38	Attack path exposure score	Exposure & Validation
39	Patch time forecast	Exposure & Validation
40	Detection gap synthesis	Exposure & Validation
41	BAS test evidence matching	Exposure & Validation
42	Rule regression predictor	Exposure & Validation
43	Passive protocol anomaly	OT & IoT
44	OT asset role profiling	OT & IoT
45	Remote engineering session risk	OT & IoT
46	Process context deviations	OT & IoT
47	Edge fleet anomaly	OT & IoT
48	Firmware change alerting	OT & IoT
49	Playbook suggestion	Security Operations
50	Containment impact forecast	Security Operations
51	Shift load prediction	Security Operations
52	Incident executive digest	Security Operations
53	Log cost optimization	Security Operations
54	Root-cause candidate rank	Security Operations
55	RAG grounding checker	AI Trust & Quality
56	SOC copilot hallucination detector	AI Trust & Quality
57	Prompt injection filter	AI Trust & Quality
58	Analyst-feedback model	AI Trust & Quality
59	Calibration drift monitor	AI Trust & Quality
60	Model incident regression	AI Trust & Quality

Otonomi seviyeleri ve karar yetkisi

Seviye	İzin verilen çalışma	Zorunlu kontrol
L0 – Gözlem	Pasif sinyal, log, grafik, eğitim ve rapor üretimi	Rol ve tenant erişim yetkisi
L1 – Öneri	Özet, sorgu, hipotez, kural taslağı, tavsiye	Kaynak kanıtı ve güven düzeyi
L2 – Hazırlık	Playbook dry-run, containment planı, change taslağı	Analist görüp onay verir
L3 – Sınırlı otomasyon	Geri alınabilir düşük etkili etiketleme/yönlendirme	Policy allowlist, TTL, circuit breaker
L4 – Kontrollü müdahale	Hesap/session iptali, cihaz izolasyonu, kritik rule change	Yetkili insan onayı + iş etki değerlendirmesi
L5 – Yasak varsayılan	OT komutları, tüm ağı durdurma, yıkıcı silme	Varsayılan deny, ayrıca mevzuat ve emniyet incelemesi