Question 1

Is SARA Open free to use?

Accepted Answer

Yes. SARA Open is free for anonymous use. The chat, IOC enrichment, phishing analysis, EPSS / KEV / CVE lookup, and Sigma rule generation are all available without an account. Rate limits apply at very high volume.

Question 2

What can SARA do that ChatGPT can't?

Accepted Answer

SARA enriches indicators against live threat intel sources (VirusTotal, AbuseIPDB, GreyNoise, OTX, EPSS, KEV), maps findings to MITRE ATT&CK, and produces deterministic audit-grade output with citations. Foundation models hedge or hallucinate; SARA's output guards keep responses confident when evidence supports and clear when it doesn't.

Question 3

Does SARA Open need an API key?

Accepted Answer

No API key is needed for the web chat or the free tools. An OpenAI-compatible API is available for SOAR / SIEM embedding — request an API key via the SIRP Labs contact form.

Question 4

Is my data sent to OpenAI or Anthropic?

Accepted Answer

SARA Open routes most queries through SIRP's own OmniSec LLM stack. A small percentage of complex reasoning paths may use third-party providers; sensitive data handling and enterprise on-prem deployment options are available via SIRP OmniSense.

Question 5

What is SIRP OmniSense?

Accepted Answer

OmniSense is SIRP's governed Autonomous SOC platform — the engine that powers SARA's enrichment, classification, and response actions. Enterprise customers run OmniSense on-prem or in their own cloud with full audit trails and per-tenant policy controls.

Question 6

Can SARA take destructive actions on my behalf?

Accepted Answer

Destructive actions (block IP, isolate host, revoke credentials, etc.) require four independent approval layers in SARA: tenant policy, permission tier, audit-emission gate, and admin override. Anonymous web users cannot trigger destructive actions; authenticated tenant users see proposed actions and approve them explicitly.

Triage, hunt, or detect?

🚨 Analyze an Alert

Submit Feedback

🔬 OmniSense Enrichment Agent