MAXI AI SOC is UnderDefense’s next-generation agentic AI platform that delivers continuous threat detection, enrichment, and automated context gathering across identity, endpoint, cloud, network, and SaaS environments. Unlike traditional AI security tools, MAXI AI SOC operates as a unified security operations layer on top of any existing SIEM/XDR, maintaining full customer ownership of their stack without vendor lock-in.

How does MAXI AI SOC differ from competitors?

MAXI AI SOC differentiates through: (1) Every investigative step is observable and auditable – no black box AI, (2) Can work on-prem in customer-specific cloud environments (Azure, GCP, AWS, Oracle), keeping logs and AI data in your data lake, (3) Available via OpenAI and Perplexity for Enterprise AI customers, (4) Preserves existing investments by integrating with customer-owned SIEM/EDR/cloud logs, (5) Agentic AI that collaborates with users via ChatOps to validate anomalous behavior at scale, (6) Detection Logic as Code with Python-based rules versioned, unit-tested, and deployed via CI/CD.

What problems does MAXI AI SOC solve?

MAXI AI SOC solves critical security operations challenges: (1) Allows scaling without adding more people by replacing routine T1-T2 work, (2) Reduces internal workload and burnout by automating enrichment, triage, and user verification for thousands of alerts daily, (3) Eliminates blind spots created by disparate tools that don’t integrate or generate excessive noise, restoring full operational visibility, (4) Provides transparent investigation workflows so your team knows exactly what the AI did and why.

Can MAXI AI SOC work with my existing SIEM?

Yes. MAXI AI SOC is specifically designed to integrate with customer-owned SIEM, EDR, and cloud logs instead of forcing a switch to proprietary stacks. It supports Elastic, Splunk, QRadar, LogRhythm, Microsoft Sentinel, and other major SIEM platforms. This approach preserves your existing security investments while adding AI-powered detection and response capabilities.

Is MAXI AI available through enterprise AI platforms?

Yes. MAXI AI is available directly via OpenAI and Perplexity for Enterprise AI customers. This enables organizations already using these enterprise AI platforms to access UnderDefense’s security operations capabilities through their existing AI infrastructure and workflows.

MAXI AI SOC is an agentic AI security operations platform that blends AI-driven precision with elite human expertise across detection, investigation, response, and compliance. A network of autonomous AI teammates cuts investigation time 153x and removes 99% of alert noise, while human analysts validate every outcome for next-gen managed detection and response.

How does MAXI AI SOC work?

A multi-agent AI system autonomously handles up to 80% of Tier 1 and Tier 2 SecOps tasks. It analyzes raw data, delivers enriched context behind every alert, and can contain threats within five minutes of detection. Human experts review the AI's work, so you get fast, outcome-driven response at scale.

What makes MAXI AI SOC different from traditional SOC tools?

Instead of generating more alerts, MAXI AI SOC uses agents, workflows, MCP, and RAG to boost performance over 70% and remove 99% of noise. It is powered by eight years of real incident data, covers 99%+ of MITRE ATT&CK, and keeps a human in the loop to validate every decision.

Who should use MAXI AI SOC?

MAXI AI SOC suits security teams and CISOs at scaling companies who are overwhelmed by alert volume and want to free analysts from repetitive Tier 1 and Tier 2 work. It is ideal for organizations standardizing on AWS and Azure that need cloud-native detection, response, and compliance automation in one platform.

How fast does MAXI AI SOC respond to critical alerts?

MAXI AI SOC commits to a 20-minute SLA response time for critical alerts and can automatically contain threats within five minutes of detection. Its AI agents enrich each alert with full context, while expert SecOps teammates handle investigation, response, and threat intelligence to keep mean time to respond consistently low.

Model Context Protocol

MAXI in your harness

A remote MCP server that exposes your MAXI detection, exposure and compliance data to Claude, Claude Code, Cursor, VS Code and any MCP-capable harness. Read-focused, scoped to your own account and role, with every call authenticated and logged.

Install the connector Request a demo

MCP server URL

https://mcp-gateway.us.app.underdefense.com/mcp

Streamable HTTP transport. OAuth 2.1 with PKCE and dynamic client registration. Choose the wrong region and sign-in will fail — your account does not exist there.

Transport: Streamable HTTPRemote, over TLS
Authentication: OAuth 2.1 + PKCEDynamic client registration
Data regions: US & EUIndependent deployments
Access model: Read-focusedInherits your MAXI role

Supported clients

ClaudeClaude CodeChatGPTCursor VS CodeCodexWindsurfZedCustom harnesses

Installation

Pick your harness, install in one click

Choose your region and harness. Where the editor supports deeplinks, the button writes the configuration for you; everything else is a command or config block you can copy. Authentication is interactive in every case — no credentials are stored in any file.

Install MAXI MCP

Data region

Verify the origin. An MCP install deeplink writes server configuration directly into your editor, and the payload is opaque once encoded. Confirm the domain before clicking one — here or anywhere else — and use the manual config below if you would rather read what you are adding.

Capabilities

What you can actually ask it

The connector reads the same records your console account can already reach. It answers questions; it does not act on your environment. Below is what the data supports, with the kind of question each area handles.

Incident investigation

Pull the whole story behind an incident: the timeline, the hosts involved, the evidence collected, and the reasoning that led to the verdict.

Walk me through incident 4821 — what evidence led to that verdict?

Alert triage and tuning

See what was closed as noise and why, find detections that fire more than they used to, and spot the rules worth tuning.

Which detections produced the most false positives this month?

Asset coverage

Find endpoints without an agent and log sources that stopped reporting. Coverage gaps are usually silent, so they are worth asking about rather than waiting to notice.

Any endpoints missing an agent, or log sources that went silent?

External exposure

Review external attack surface findings: exposed services, newly opened ports, certificates approaching expiry, and how the current picture differs from last month.

What did we expose to the internet in the last 30 days?

Cloud posture

Check misconfigurations and risky changes across your cloud accounts, weighted by what actually reaches production.

Which cloud misconfigurations touch internet-facing workloads?

Response history

See what the SOC did and when — containment actions, escalations, handoffs, and who authorised each step.

What containment actions did we take this week, and who approved them?

Compliance evidence

Check control status across your frameworks and identify where evidence is missing or stale ahead of an audit window.

Which SOC 2 controls still have no evidence attached?

Reporting

Assemble volumes, response times and notable incidents into a summary for a board pack, a client report, or an internal review, with the underlying records cited.

Summarise last month: volume, response times, and the two incidents that mattered.

Every request passes through the gateway

Your harness never reaches MAXI services directly. A regional gateway terminates every session: it validates the bearer token, resolves the tenant and role behind it, checks the requested tool against policy, and writes an audit record before anything is queried.

Authorisation happens at MAXI, not in the harness. The OAuth flow returns a scoped token tied to your identity, so SSO and MFA apply exactly as they do in the console, and revoking the user revokes the connector with it.

There is no second permission model to maintain. The connector resolves entitlements from the role you already hold — a record you cannot open in the console cannot be returned to a harness either.

1AI harnessTurns your question into a tool call and sends it with your access token.
2Regional MCP gatewayValidates the token, applies tenant and role policy, records the call.
3MAXI servicesReturn only the records your account can see, in the region where your data lives.

Security & compliance

Built for the reviewer, not just the user

The questions your security team will ask before approving this connector — answered up front.

What data leaves MAXI: Only the records needed to answer the question asked — incident, alert, asset, exposure and compliance data the account can already access. Nothing is exported in bulk.
Authentication: OAuth 2.1 with PKCE and dynamic client registration. No API key to create, store or rotate. The harness never receives a MAXI password, and tokens expire.
Authorisation: The connector inherits your existing tenant and role model. If an account cannot see a record in the console, it cannot see it through a harness.
Write access: The connector does not modify detection rules, policies or platform configuration.Read-focused
Audit logging: The gateway records who called what and when. Activity through a harness is attributable to a user and tenant, exactly like console activity.
Data residency: Two independent regional deployments, US and EU. A request to one region is never served from the other.
Network requirements: A public HTTPS endpoint reached outbound. No inbound firewall rules, no VPN, no on-premise component.
Offboarding: Disabling a user in MAXI removes their access through every harness at once, because the token is tied to their MAXI identity.
Model training: MAXI data is not used to train models. Handling of conversation content follows the terms of the harness in use.
Untrusted content: Records returned from MAXI can contain attacker-controlled text — hostnames, filenames, email subjects, command lines. Treat model output derived from them as untrusted input, and keep a human in the loop before acting on any instruction that appears to originate from alert data.
Scope of the answer: Each response reflects the records retrieved at query time. The connector is not a system of record and does not replace the console for response actions, case management or evidence retention.
Local components: None required. The connector is a remote server reached over HTTPS. If your harness only speaks stdio, the configuration we provide pins a known-good release of the open-source bridge, which you maintain like any other dependency.

Support

Troubleshooting

The install button did nothing

Your browser needs permission to open the editor. Allow the prompt, or use the manual configuration shown under the button — it produces exactly the same result.

Sign-in fails, or my account is not found

You are almost certainly pointed at the other region. Remove the server from your harness, then add it again using the endpoint for the region where your MAXI tenant lives.

I am connected, but no data comes back

Your MAXI role may not cover the data you asked about. The connector never returns more than your console account can see. Ask your MAXI administrator to review your permissions.

The connection worked, then stopped responding

Access tokens expire, and administrators can revoke them. Disconnect and reconnect the server in your harness to sign in again. Your MAXI data is unaffected.

I see an authentication error in a terminal harness

Cached OAuth state can go stale. If you use the mcp-remote bridge, clear its cache with rm -rf ~/.mcp-auth and connect again. Also confirm you are on a current Node.js release.

Do I need an administrator to enable this?

On Claude Team and Enterprise, a workspace owner enables the connector once for the organisation; after that each person connects with their own MAXI account. On individual plans and in coding harnesses you can add it yourself. Either way you only ever see what your own MAXI role allows.

Answers look out of date

Ask the harness to re-check MAXI. Each answer reflects the data pulled at the moment the question was asked; nothing is cached between sessions.

Add it to your harness, or bring your security team a question we have not answered here.

The connector is supported by the same team that runs the platform. Architecture and review questions go to the same place.

Install the connector Talk to an expert