Zero-Noise

Core Concept Zero-Noise is an automated, multi-agent Security Operations Center (SOC) pipeline that eliminates alert fatigue by processing raw system telemetry and outputting only verified, actionable incident reports. The Problem Traditional rule-based Intrusion Detection Systems (IDS) generate an overwhelming volume of false positives. Human security analysts waste critical hours reading benign logs (e.g., failed passwords, routine vulnerability scanners) to determine if an alert represents a genuine breach. The Solution Zero-Noise replaces static rule-sets with a modular agentic architecture powered by open-source LLMs hosted on AMD Instinct MI300X GPUs. It acts as an autonomous Tier 1 security analyst. Technical Architecture * Ingestion Layer: Consumes standard enterprise telemetry, specifically Nginx Web Application Firewall (WAF) logs and Linux Auth (sshd/sudo) logs in JSON format. * The Parser Agent: Ingests the raw logs and translates machine-data into plain-English behavioral summaries (e.g., "Multiple 403 errors on /api/auth followed by a successful SSH login from the same IP block"). * The Analyst Agent: Cross-references the parsed behaviors against known attack vectors (such as SQL Injection or Privilege Escalation). It acts as the filter, discarding standard network noise and false positives. * The Reporting Agent: Structures verified threats into a clean, markdown-based incident report detailing the attack path, severity, and compromised assets. Why AMD Developer Cloud? Parsing thousands of log lines simultaneously requires massive context windows and high-throughput memory. By deploying our orchestration framework on ROCm and the MI300X, Zero-Noise achieves the sub-second inference speeds necessary to process log data in real-time without bottlenecks.