Laya — the SOC decision engine
Reports, guides, and the control plane for the Laya decision engine deployed in the agentic SOC — CPU-only inference, loopback-bound, deterministic-gated.
Reports
- Laya 300 — Status & Power Report (2026-09-27)
The 300-gate run on the control host: shadow evals, agreement analysis, the GPU power story (4.92 → 1.29 kWh/day, −74% GPU energy), and the phase plan.
- Laya 300 — Eval-Host Replication & Comparison (2026-09-28)
The same 300-state eval re-run on a second host (Ryzen 7 7800X3D): 1.6× faster, 100% identical answers, energy per decision −20%. Cross-host agreement 100/300 states on all three decision metrics.
- How to Use Laya — Practical Guide
Endpoints, state-building discipline, threads, checkpoints, and the shadow/gated modes.
- Laya + SOC — Setup, Install, Configure, Validate
The demo walkthrough: install the venv, preload the checkpoints, wire the shadow hook, validate the decision path.
Control plane & eval harness
The serving layer, eval harness (300-gate + baselines), GPU power control, and the
loopback-to-docker-bridge MCP forwarding pattern are maintained in
laya-control —
evals/laya-300-run.py is the 300-state comparison driver; the results for
both hosts ship alongside it. The Wazuh stack it sits on is documented in
wazuh-stack.
SOC contract, in one line: every alert passes a deterministic
severity gate first; Laya classifies the response on CPU in ~0.5 s with no cloud call, and the
deterministic rule stays authoritative. Same answers on any host — validated across two.
For capability statements or a live walkthrough:
info@bedimsecurity.com.
Alert-sample IPs/domains in the eval data are anonymized (RFC 5737 / example.com);
internal host names are replaced by role labels. Companion:
soc-openclaw,
agentic-ai,
stig-baselines.