I spent the last few weeks turning a rough idea into something that actually runs. Gardien is an AI-augmented Tier 1 SOC analyst. It ingests SIEM events, enriches them with threat intel, runs them through a language model, and pushes the result to Slack, Discord, email, or a webhook.

Anyone who has worked a SOC queue knows the shape of the problem. Alerts pile up across a dozen tools, most of them are noise, and the ones that matter get buried under the ones that don't. I wanted to see how much of the triage I could automate without automating away the judgement that makes an analyst worth having.

What came together quickly

The core loop was the easy part: scan, create the alert, run the analysis, route it. I built in multiprovider AI support (OpenAI, Anthropic, Google, DeepSeek, Groq, Mistral, OpenRouter, plus custom endpoints) so teams can pick based on budget rather than being locked to whatever I happened to prefer.

What ate the time

Two things, and neither was the AI.

Wazuh integration. Wazuh is a solid SIEM but it does not want to be integrated with. Basic auth with Base64-encoded credentials, a manager and an indexer that are not the same thing and do not behave the same way, and self-signed certificates the edge runtime flatly refused to trust. I ended up shipping a trust self-signed cert option and a CA certificate paste path so people could connect without standing up a reverse proxy first.

Moving to my own infrastructure. The first version ran on a managed platform, which was fine for prototyping but meant I did not control the stack. Frontend went to Vercel, backend to my own Supabase project: recreating cron jobs, redeploying edge functions, migrating secrets, reconfiguring auth providers. Useful reminder that "it works in the prototype" and "it works in production" are different claims.

Where I landed

Gardien is not going to replace an analyst and I would not want it to. What it does is hand back the hours currently lost to alert triage, hunting for log context, and copying values between tabs. If the tool can summarise the event, pull host, rule, source IP, and full log context into one place, and suggest a remediation path, the analyst gets to spend their attention on the decision instead of the assembly.

It currently handles Wazuh, Splunk, Elastic, Sentinel, QRadar, Chronicle, and custom sources. Scheduled scans, automatic analysis, notifications that arrive with context already attached. Plenty left to improve, but it runs in production on my own infrastructure, which was the bar I set.

Debugging TLS and reading edge function logs at midnight taught me more than the tutorials did.