Overview

What Rokkhe does, and the loop it runs.

Rokkhe is two halves of one loop. The offensive half points an autonomous pentester at a target you name and proves what is exploitable. The defensive half takes the telemetry you already produce and turns it into investigated cases. They share one workspace, so a proven exploit and a detection gap describe the same system rather than two disconnected reports.

#The engagement loop

1. Scope — you name the targets. Nothing outside them is touched.
2. Map — routes, parameters, auth flows, dependencies, and misconfigurations.
3. Prove — a working proof-of-concept, run inside a container sandbox.
4. Fix — the remediation opens as a reviewable pull request.
5. Retain — findings, proofs, and the decisions taken stay attached to the run.

#The SOC loop

1. Receive — registered collectors send events into a workspace.
2. Correlate — related signals become one case rather than four tickets.
3. Investigate — agents retrieve context and compare hypotheses against retained evidence.
4. Approve — consequential response waits for a named person.
5. Retain — the case keeps what justified each decision.

#What you interact with

#Where it runs

The whole platform self-hosts on infrastructure you operate — one VM with Compose is enough. Nothing calls home. The only outbound traffic is what you configure: your model provider, and whichever integrations you connect. See /docs/self-hosting for the stack and /docs/security for what is isolated from what.