medOS ultra
ProductsmedOS PlatformSecurity & RUDS

medOS Platform

Security & RUDS

Behavioral threat detection, fail-open

Rogue-user detection across all 16 services: a unified action-event stream, JSON-predicate detection rules, two-tier scoring and an AI second opinion that can flag but never block.

ruds — behavioral threat detection · /security/ruds
17 SEED RULES · INLINE + NIGHTLY BATCH monitoring
Credential stuffing0 today
Bulk record export1 flagged
Off-hours API spike0 today
Concurrent session2 flagged
LLM abuse pattern0 today
Privilege escalation0 today

AI second-opinion (Haiku/Sonnet) for novel patterns — AI cannot block, cannot push to red tier. Inline scorer <50ms.

Capabilities

Unified user_action_events stream across auth, API, LLM and patient access

17 seed rules: credential, exfiltration, snooping, escalation, LLM abuse

Inline scorer <50ms + nightly batch + per-user baselines

AI second opinion: cannot block, cannot escalate to red, no PHI in prompts

SOC dashboard + step-up auth + identity-VPN add-on

Inside the SOC

Every action scored in under 50ms

The same dashboard your security officer watches — a live event tail, risk-tiered users, and an AI second opinion that can flag a novel pattern but never block. The stream below is running; filter it, drill into a flagged user, and lock an account.

ruds — security operations center · /admin/security/dashboard
17 SEED RULES · INLINE + NIGHTLY BATCH · 53K EVENTS/DAY
monitoringscorer p95 41msregion TH
Critical
2
High
5
Medium
9
Low
3
Above green
6
Live event tail
7READ_PATIENT14:32:11
dr.cruz · clinical · TH·Bangkok
12LOGIN14:32:06
n.ward · auth · TH·Bangkok
71EXPORT_CSVblocked · 42314:32:01
a.lim · financial · TH·Bangkokexport.bulk_csv_v1
91BILL_VOIDblocked · 42314:31:58
r.santos · financial · TH·Chonburiworkflow.bill_void_storm_v1
67READ_PATIENTalert14:31:50
dr.tan · clinical · TH·Bangkokread.bulk_patient_v1
88LOGIN_FAILEDblocked · 42314:31:30
ext · gateway · 45.13.x.x·anonlogin.brute_force_v1
58DISPENSEalert14:31:09
a.cruz · medication · TH·Bangkokworkflow.controlled_no_order_v1
9UPDATE_NOTE14:31:02
dr.ong · clinical · TH·Bangkok
Above green tier6
Cashier · Billing
r.santos
91red
lockout active · 423
Behavioral baseline
usual hours
08:00–18:00
geo
TH · Chonburi
devices
1 device
read p95
40 · h⁻¹
peer group
cashier · billing
Matched rules · last events
workflow.bill_void_storm_v1access.off_hours_v1
14:31:58 BILL_VOID · blocked
14:30:12 BILL_VOID
14:28:44 BILL_VOID
02:15:03 LOGIN · off-hours
Top-firing rules · 24h
login.brute_force_v1142
login.new_country_v138
access.off_hours_v121
session.concurrent_v114
read.bulk_patient_v19
workflow.bill_void_storm_v13
AI second opinionhaiku-4.5

Novel pattern. 3 registration clerks each opened the same VIP chart within 9 min of admission. No single rule fired — correlated across users.

confidence0.81
cannot blockcapped at orangeno PHI in prompt

See Security & RUDS on your workflows

Ask Anything