Quarry

Open-source Bacen Evidence Engine for Brazilian fintechs. Replace the consultant-and-spreadsheet workflow with a deterministic, citable, exportable evidence pipeline for BCB 85/2021, Bacen Comunicado 44.323/2024 (24h), LGPD/ANPD (Res. 15/2024, 3 business days), and Open Finance. Bacen-native by construction, not by retrofit. Strengthens governance, increases auditability, and preserves regulatory evidence — does not substitute regulatory obligation nor guarantee supervisor acceptance.

🌐 Live sandbox · 📘 Docs · 🛡️ Security policy · 🇧🇷 Resumo em Português

---

The problem

A serious investigation in a Brazilian fintech today has to correlate Pix events, mobile banking authentication, device behaviour, Open Finance access, boleto creation, account takeover attempts, mule accounts, fraud alerts and regulatory reporting. That work currently depends on a senior analyst who knows how to turn a vague incident brief into a sequence of queries, hypotheses and evidence.

It does not scale. And it does not fit an imported SIEM that was never designed for Pix, BCB 85/2021 or LGPD.

What Quarry does

Quarry makes the senior-investigator workflow executable, measurable and repeatable — without removing the human from the approval loop:

• LangGraph orchestrator with a parallel router (phishing · identity · cloud · insider) that decomposes one alert into simultaneous sub-investigations.
• Investigation Ledger — every LLM prompt, every tool call, every cited document is recorded and auditable. You can defend the conclusion in a Bacen audit or a court case.
• CI eval harness with 5 deterministic suites: MITRE accuracy, alert reduction, investigation completeness, response quality, schema coverage.
• Multi-source detection corpus (SigmaHQ · MITRE CAR · Splunk Security Content · Chronicle) with per-rule provenance.
• MCP server to plug Claude Desktop, Cursor, Cody and other assistants into the same investigation chain.
• Brazilian customizations in customizations/: pt-BR hunts, Sigma rules calibrated for Brazil's payment ecosystem (Pix, BCB, LGPD), and compliance evidence automation for local audits.

What this is not

Quarry does not replace your SOC; it increases its throughput. It is not a managed-SOC service, and it does not try to compete with tier-1 vendors on generic features. Generic SIEM/SOAR is out of scope.

Heritage

Quarry is an independent MIT fork of AiSOC (commit 28ce9f6b). Upstream attribution is preserved verbatim in LICENSE, NOTICE.md, and README.AISOC.md. Inherited components (orchestrator, ledger, MCP server, eval harness, base detection corpus) are credited to their original authors; Quarry-specific work lives under customizations/.

---

Quick start

Requirements: Docker 24+ and Docker Compose v2.

git clone https://github.com/Josepassinato/Security.git quarry
cd quarry
cp .env.example .env                       # fill in OPENAI_API_KEY and generate QUARRY_CREDENTIAL_KEY
docker compose -f docker-compose.demo.yml up -d

In about 2 minutes:

• API at http://localhost:8000 (GET /health)
• UI at http://localhost:3000
• Postgres, Redis, Qdrant, OpenSearch and Neo4j come up as containers
• The demo profile seeds synthetic alerts from the FinPlay Pagamentos dataset (CPFs, Pix keys and events generated by seed — no real institution)

# run an investigation against the demo dataset
curl -s http://localhost:8000/v1/investigations -X POST \
  -H "Content-Type: application/json" \
  -d '{"alert_id":"demo-pix-mule-001"}' | jq

# open the forensic ledger
open http://localhost:3000/investigations

For production deploys (air-gapped, self-hosted VPS, Kubernetes), see docs/operations/.

---

Architecture in 30 seconds

                ┌─ Alert ingress (SIEM, log shipper, MCP)
                │
                ▼
       ┌─────────────────────┐         ┌──────────────────────────┐
       │  LangGraph Router   │ ───►    │  Investigation Ledger    │
       │  (parallel sub-     │         │  (Postgres + hash chain) │
       │   investigators)    │         └──────────────────────────┘
       └─────────────────────┘                   ▲
                │                                │
                ▼                                │
       ┌─────────────────────┐                   │
       │  Detection corpus   │                   │
       │  + Brazilian Sigma  │  ─── evidence ────┘
       │  + Hunt templates   │
       └─────────────────────┘
                │
                ▼
   Citation-validated report  ──►  Analyst review  ──►  Action / SAR / ANPD draft

Deep dive: docs/pt-br/orchestrator-deep-dive.md.

---

Current status

Quarry is in early access. The core inherited from AiSOC (eval harness, ledger, MCP server) is stable; the Brazilian customizations are being validated with synthetic data and private pilots.

Capability	State
LangGraph orchestrator + auditable ledger	✅ Stable (upstream AiSOC)
CI eval harness (5 suites)	✅ Stable
MCP server	✅ Stable
Detection corpus + provenance	✅ Stable
Brazilian customizations (Pix, BCB 85, LGPD)	🟡 Validating — 11 patterns published
FP reduction benchmark (FinPlay BR)	✅ Published under customizations/benchmarks/
Public demo	🟢 quarry.12brain.org
Production-ready in regulated fintech	⏳ Pilots under NDA — get in touch

⚠️ Do not run in production without a guided pilot. The project is open-source, but the compliance, detection calibration and integration work is still done per pilot. See SECURITY.md for vulnerability reports.

---

Repository layout

quarry/
├── apps/                     Next.js frontend + docs site
├── services/                 14 microservices (Python + Go)
├── packages/                 Shared SDKs and libraries
├── detections/               Imported corpus with per-rule provenance
├── playbooks/                Response playbooks
├── customizations/           ⭐ Everything Quarry-specific (BR, Pix, BCB, LGPD)
│   ├── detections/             Sigma rules calibrated for Brazil
│   ├── threat-intel/br-fintech/ 11 patterns (Pix / ATO / Boleto / QR / …)
│   ├── hunts/                  pt-BR hunt templates
│   ├── prompts/                pt-BR prompts
│   ├── compliance/             BCB 85/2021 and LGPD evidence
│   └── benchmarks/             Publishable runs (auto-triage on FinPlay BR)
├── infrastructure/           IaC (VPS, Kubernetes, Helm)
├── docs/
│   ├── adrs/                   Architecture Decision Records
│   ├── pt-br/                  Portuguese manuals and runbooks
│   ├── operations/             Deploy, hardening, air-gap
│   └── compliance/             ISO 27001, NIST CSF mappings
└── examples/                 Ready-to-clone examples

---

Design principles

• Customization is kept separate from upstream. Anything Quarry-specific lives under customizations/. This enables controlled cherry-picks of upstream AiSOC improvements.
• English in code, Portuguese in operations. Identifiers, logs and conventional commits (feat: / fix:) are English; runbooks and ADRs are Portuguese.
• Adversarial-agent assumptions. Human operators may be hostile or compromised. Auditability is a design constraint, not an optional feature.
• Rigorous attribution. NOTICE.md lists AiSOC and every detection corpus (SigmaHQ/DRL-1.1, MITRE CAR/Apache, Splunk/Apache, Chronicle/Apache, Anthropic Cybersec/Apache-2.0).
• No rebrand of public research. Quarry does not present inherited work as original. See README.AISOC.md.

---

Community & Contributing

Issues, PRs and bug reports are welcome. The community surfaces are:

• GitHub Discussions — open questions, ideas, roadmap input
• Issues — bug reports and feature requests (good first issues are tagged for newcomers)
• Pull Requests — see CONTRIBUTING.md for flow, commit conventions and how to run the eval suite
• Vulnerabilities — do not open a public issue, follow SECURITY.md
• Code of conduct — CODE_OF_CONDUCT.md

A chat server (Discord / Slack) will be set up once the community needs it. For now, GitHub Discussions is the canonical place to talk.

Areas open for contribution right now:

• 🇧🇷 pt-BR hunts for other verticals (government, retail, healthcare)
• 🧠 Prompts and few-shots for the orchestrator
• 📚 Detection rules calibrated to Brazilian threat actors
• 🧪 Eval harness extensions and synthetic dataset additions

Sponsors: if you want to fund maintenance time, see the Sponsor button on the repo home or check .github/FUNDING.yml.

---

License

MIT — see LICENSE. Upstream attributions in NOTICE.md and README.AISOC.md.

---

Resumo em Português

Quarry — SOC soberano open-source para fintechs brasileiras reguladas pelo Bacen.

Investigação assistida por LLM com cadeia probatória citável, rodando dentro do seu perímetro. Mapeamento direto com Resolução BCB 85/2021 e LGPD.

• Para quem é: fintechs Bacen-licenciadas (SCD, SEP, Conta de Pagamento, PSTI, Payment Initiator, CCB) que precisam atender o monitoramento contínuo da Res. BCB 85/2021 sem o custo de um MSSP enterprise.
• Como funciona: orquestrador LangGraph com router paralelo, Ledger de Investigação auditável (hash chain), eval harness em CI, MCP server para Claude Desktop / Cursor / Cody, e customizações brasileiras (Pix, BCB, LGPD) em customizations/.
• Demo público: quarry.12brain.org
• Licença: MIT (herdada do upstream AiSOC)
• Status: early access. Pilotos sob NDA em curso. Não rodar em produção sem piloto guiado — a calibração de detecção e a integração regulatória são feitas por piloto.

Reports de vulnerabilidade: SECURITY.md. Contribuições: CONTRIBUTING.md.