Triage that names the attack, not the policy
An L1 looking at 200 alerts does not have time to rephrase a question until the model agrees it is hypothetical. They need a first pass that says what this looks like and what to pull next.
In-house SOCs and MDR providers who already see this telemetry under contract.
Why the mainstream APIs fail here
Alert text includes payloads, encoded PowerShell, and lure copy. Frontier APIs treat the alert as the attack. The analyst is the one who caught it. The refusal adds a ticket, not a finding.
How Redline is used for this
A Playground key for humans, a capped API key for the SOAR hook. Same catalogue, same bill. The hold is taken before the model runs, so a noisy rule cannot spend the month's budget in an hour.
A working loop
- Wire the SOAR action to /v1/chat/completions with a key whose monthly cap is the SOC AI budget.
- Send the alert, not the whole tenancy.
- Let L2 open the Playground on the same account when the first pass is wrong.
Prompts are not stored. A signed receipt of the hash comes back on every call, so you can prove later what Redline logged. Details are on the privacy page. Per-model prices are on /models and the pricing model is on /pricing.