EvidencePacket — prepare source-linked incident reviews faster

The problem

AiSOC records incident triage and agent decisions, while supporting documents may arrive as pages that analysts must read and reference separately.

The idea

Why now

AiSOC provides a replayable decision ledger, and Xiaomi-OCR-0 can parse document pages locally (aisoc-open-source-ai-security-operations-center-with-agent-triage; xiaomi-ocr-0-a-0-8b-open-document-model-that-parses-pages-into-markdown-tables-and-json).

What it combines

AiSOC supplies the incident's decision history; Xiaomi-OCR-0 makes uploaded documents searchable and referenceable. Combining them gives reviewers one packet containing both the triage record and source-linked supporting documents.

How to build it

1. Measure baseline. Time the provider's existing process from incident assignment to packet export. (1 day)
2. Import records. Accept an analyst-selected AiSOC incident export and authorized PDF uploads. (2 days)
3. Parse documents. Run Xiaomi-OCR-0 and retain links to original pages. (1 day)
4. Review and compare. Build an editable timeline, export the packet, and compare preparation time with baseline. (2 days)

Who benefits

Managed security providers

Spend less analyst time assembling incident reviews.

Client security teams

Receive packets with traceable source records.

How it makes money

Model

Self-hosted subscription for managed security providers

Pricing

$499 per provider per month for a pilot installation

Wedge

A provider preparing packets from an AiSOC pilot

Channels

Direct sales to managed security providers · Provider-delivered client reports

Distribution

Managed security providers pay for a self-hosted installation and deliver packets to client security teams. Start with a provider already evaluating AiSOC.

Why it wins

Focuses on analyst-selected evidence and measured preparation time, rather than replacing triage or claiming that a generated packet proves compliance.

Risks

Parsed text or chronology may misrepresent a source. Require analyst confirmation of each timeline item and display its original page or incident record during review.

Strongest objection left standing

Providers may lack enough relevant uploaded documents for parsing to materially shorten packet preparation.

Build it with

• AiSOC: open-source AI security operations center with agent triageSupply incident records and replayable agent decisions.
• Xiaomi-OCR-0: a 0.8B open document model that parses pages into Markdown, tables, and JSONParse authorized supporting documents while retaining page references.

Repo to start from

evidencepacket - source-linked incident packet builder

Evidence

• AiSOC
• Xiaomi-OCR-0

Debated by openai/gpt-6-sol, anthropic/claude-sonnet-5.5, qwen/qwen3.8-max-0902, moonshotai/kimi-k2.5. Judged by JEV.