Logs with delivery context
Import reviewed server and application logs. Collection, delivery, and event activity are tracked separately, so a quiet source and a delivery problem can be investigated on their own terms.
Read the server-log guide →← Our softwareBB SOC: security operations.
BB SOC · Built at Bulwark Black
BB SOC: security operations.
Evidence before action.
BB SOC is the security operations console I built to support monitoring, alert investigation, and incident response across my own systems. I'm Albert LaScola, the sole security lead and owner of Bulwark Black LLC.
The public BB SOC Skeleton shares reusable software and setup documentation for a private, self-hosted console. It is a beta starter that needs configuration, testing, and an operator responsible for the environment.
- Built and operated by
- Albert LaScola · Bulwark Black LLC
- Public release
- Beta · Single-tenant starter
- Decision ownership
- Human review and authorization
From my own security practice
Bring the evidence into one place.
Monitoring produces different kinds of information: logs from applications, observations about infrastructure, detection matches, and notes from an investigation. BB SOC brings those pieces into a private interface so the evidence and the decisions can be reviewed together.
My own use centers on Bulwark Black's systems. The public repository documents capabilities others can configure for their environments. It contains no Bulwark Black operational telemetry or private inventory, and does not establish which integrations are active in my deployment.
Documented in the public starter
What the software supports.
Infrastructure observations
Bring configured host, service, website, metric, and incident evidence into an Operations view. Inventory and sources need setup; recording a job or worker does not start it.
Explore native Operations →Detections for review
Enable selected rules for supported authentication, audit, and logging events. Each match is a signal to investigate, with source and policy requirements documented alongside the rules.
Review detection coverage →Findings and decision history
Group findings, review evidence, record proposals, and track approval progress. Native Triage keeps the investigation and decisions together; remediation and fix verification remain separate work.
Read the triage workflow →The documentation also covers supported vendor event mappings, optional notifications, and scoped AI-assisted setup. Installing a preset does not connect an account or start collection.
A workflow to review
From a signal to a decision.
Configure sources
Choose the systems and supported event sources you are authorized to monitor.
Collect evidence
Review incoming events, delivery status, and the observations behind a finding.
Investigate
Use the source context to assess a signal and record the proposed next step.
Decide and verify
Authorize any response separately, then check the outcome against fresh evidence.
A detection match needs investigation; it does not prove compromise. Native Triage records evidence and approval progress. It does not launch an AI agent, execute remediation, or prove that a fix worked. That boundary keeps the operator's decision and the evidence needed to support it explicit.
Scope and evidence
Start with the published limits.
The starter is intended for a private, single-tenant deployment. A useful installation depends on the sources you configure, the rules you enable, and the people reviewing the results. The repository is implementation evidence, not an independent audit or a promise of complete detection coverage.
Documentation reviewed October 22, 2026. Refer to the repository for current setup requirements and changes.
Have a workflow that needs better tools?
BB SOC is one example of software I build around work I do myself. For your business, we can start with the users, the information they need, and the decisions the software should help them make.