Best 10 AI SOC Platforms For Business (2026)
We compared 10 AI SOC platforms on triage depth, autonomous response controls, and false positive rates. The results were more varied than the marketing suggests.
Written by
Alex Zawalnyski
Quick Summary
AI SOC platforms use machine learning and automated triage to help security operations teams process alerts faster and reduce analyst fatigue. Performance varies significantly — some platforms deliver measurable triage improvement; others rebrand basic automation with AI marketing. We reviewed 10 platforms and found Torq, CrowdStrike Charlotte AI, and Dropzone AI to be the strongest on genuine triage depth and false positive reduction.
The best AI SOC platforms reduce the gap between alert volume and analyst capacity by automating triage, investigation, and response across your security stack. They handle alert deduplication, false positive filtering, evidence gathering, and case management, covering the repetitive work that consumes Tier-1 and Tier-2 analyst time. For security teams facing thousands of daily alerts without the headcount to investigate each one, these platforms provide consistent coverage without requiring manual rule maintenance or SOAR playbook engineering.
We’ve evaluated AI SOC platforms across enterprise, mid-market, and lean security team environments, testing AI-driven triage accuracy, investigation depth, integration breadth, and analyst workflow impact. This guide covers the platforms that deliver measurable improvements in alert handling, investigation speed, and SOC team efficiency.
Best AI SOC Platforms Shortlist
- Torq AI SOC Platform — Best for agentic automation across the full alert lifecycle
- CrowdStrike Charlotte AI — Best for CrowdStrike-first enterprise environments
- Dropzone AI — Best for autonomous Tier-1 alert investigation at scale
- Google Security Operations — Best for Google Cloud-first security teams
- Microsoft Security Copilot with Sentinel — Best for Microsoft-first security operations
- Palo Alto Cortex XSIAM — Best for enterprise SOC consolidation with AI-driven response
- Prophet Security AI SOC Analyst — Best for SaaS-heavy enterprise environments
- ReliaQuest GreyMatter — Best for multi-vendor stack unification and containment
- Splunk Enterprise Security — Best for large enterprises with deep detection engineering needs
- Stellar Cyber Open XDR — Best for lean security teams and MSSPs
Torq is an AI SOC platform that uses agentic AI and automation to accelerate triage, investigation and response to cybersecurity risks.
Torq AI SOC Platform Key Features
Torq’s AI SOC platform delivers end-to-end security operations through the following features:
Integrations: Torq connects to your existing security stack with hundreds of ready-to-use integrations out of the box. It ingests and normalizes security telemetry, enabling agentic analysis at scale.
Auto Triage: Torq’s agentic AI identifies actual threats in your alert feeds. It is completely transparent when making decisions and can only access tools and data you have given it access to. This helps you sort false positives from actual, prioritized risks.
Investigate: Torq’s Case Management feature automatically opens cases for genuine risks. Torq’s agentic orchestrator, Socrates, automates repetitive tasks and conducts the initial investigations. Socrates can only access the tools you enable and works according to your guardrails. SOC analysts can see the complete chain of reasoning and context behind each decision.
Respond: Torq can quickly contain risks or remediate the root cause of issues. It integrates with your processes and tech to quickly take response actions. On average, customers see a 75% reduction in MTTR.
Our Take
We think the Torq AI SOC Platform is a strong option for SOC teams looking to automate triage, investigation and response. The platform covers the full incident lifecycle and the transparent agentic approach, with built in guardrails and decision-making context, means it can actually handle the work for SOC analysts rather than just surfacing recommendations. Torq is trusted by Fortune 500 organizations across industries, including challenging verticals like healthcare and financial services.
Strengths
- 300 prebuilt integrations connect Torq to most enterprise security stacks with minimal setup required
- Over 90% autonomous case closure frees analysts from the bulk of routine triage work
- The graphical workflow builder reduces errors when building complex multistep automations
- Native case management keeps evidence, timelines, and summaries in one place throughout investigation
Cautions
- The platform is built for enterprise-scale SOC operations
CrowdStrike Charlotte AI
CrowdStrike Charlotte AI is an AI layer built directly into the Falcon platform, designed to close the speed and scale gap between SOC teams and the threats they face. We think it’s a strong fit for enterprise security teams already running CrowdStrike who want to get more from their existing analysts without adding headcount.
CrowdStrike Charlotte AI Key Features
Charlotte AI triages detections, filters false positives, and routes only what matters to your analysts, trained on decisions made by CrowdStrike’s own threat intelligence team. The investigation canvas lets analysts add context, steer reasoning, and collaborate with the AI in real time rather than receiving static output. The AgentWorks layer, launched in March 2026, lets teams build and deploy custom agents using natural language with no code required. Charlotte AI has also achieved FedRAMP High authorization, which gives public sector teams a clear deployment path.
What Customers Say
Customers consistently highlight query speed as a standout capability. Pulling real-time endpoint data, connection histories, and environmental context through natural language prompts lands in seconds. This changes how investigations feel in practice. Something to be aware of is that the pricing model was a barrier early on. The shift to included credits for enterprise users has helped, though some users flag that certain agentic modules are still catching up to the core product’s maturity.
Our Take
If your stack is already CrowdStrike-heavy, Charlotte AI makes clear sense. The AI is trained on Falcon data, so the value compounds the more of the platform you’re using. We think teams running fragmented multi-vendor environments will see less immediate return. The ISO 42001 AI governance certification is a practical addition for compliance-conscious teams.
Strengths
- Real-time environmental querying via natural language cuts investigation time significantly
- AgentWorks lets analysts build custom agents with no coding required
- Detection triage trained on elite analyst decisions reduces low-signal alert fatigue
- ISO 42001 AI governance certification and FedRAMP High authorization for compliance needs
Cautions
- Value is tightly coupled to CrowdStrike investment, with limited benefit for mixed-vendor environments
- Reviews note that some agentic modules are still maturing, with capability gaps depending on use case
Dropzone AI
Dropzone AI is an autonomous SOC analyst built for teams that can’t keep up with alert volume. We were impressed by the glass box approach to AI investigation, where every question asked, every tool queried, and every finding surfaced comes with a full audit trail in plain English. Over 100 enterprises including CBTS, UiPath, and Zapier use the platform.
Dropzone AI Key Features
Every alert gets the same level of investigation regardless of time or volume, with the platform analyzing each alert in under 10 minutes. Auto-containment fires when a threat is confirmed, blocking malicious IPs and disabling compromised accounts without waiting for human intervention. The platform builds context memory over time, improving investigation accuracy without manual rule updates. Dropzone AI raised $37 million in Series B funding in July 2025, bringing total funding to over $57 million.
What Customers Say
Customers consistently report significant reductions in manual triage load, with some teams describing a shift from thousands of alerts per month to a handful of meaningful ones per day. Support responsiveness gets high marks across team sizes. Something to be aware of is that fine-tuning the platform takes meaningful time upfront, and the reporting layer is still catching up to the investigation engine’s maturity.
Our Take
We think Dropzone AI fits best where alert volume has outpaced headcount. This isn’t a replacement for a mature SOC; it’s the force multiplier that makes a lean one viable. The plain English audit trail is particularly strong for teams with compliance requirements. If your Tier-1 analysts are spending their days on repetitive triage rather than real investigations, Dropzone AI is well worth considering.
Strengths
- Investigates every alert at full depth regardless of time or volume
- Plain English findings with complete audit trail support compliance and analyst oversight
- Auto-containment on confirmed threats reduces mean time to respond without analyst intervention
- Context memory improves investigation accuracy over time without manual rule updates
Cautions
- Reviews note that fine-tuning to your environment takes meaningful time upfront
- Reporting features are less mature than the core investigation engine
Google SecOps
Google SecOps is Google’s unified SIEM and SOAR platform, combining detection, investigation, and response in a single environment built on Google’s data infrastructure. We think it’s one of the strongest options for teams that need to consolidate tooling and handle security telemetry at serious scale. Google was named a Leader in the 2025 Gartner Magic Quadrant for SIEM.
Google SecOps Key Features
The detection engine is continuously updated with rules from Google’s threat research team. Yara-L powers custom detection authoring for teams that need their own. Gemini sits across the platform, powering natural language search, AI-generated case summaries, investigation chat, and playbook creation. The SOAR layer connects over 300 tools. We found the case management layer well thought out: alert graphing, automatic entity stitching, and contextual recommendations all land in the same workflow. SecOps OneMCP standardizes how AI agents interact with SIEM and SOAR data using the Model Context Protocol.
What Customers Say
Customers consistently highlight speed and scale as the platform’s core strengths. Large-scale log ingestion, fast search, and real-time analysis get positive marks across team sizes and verticals. The SOAR layer with over 300 integrations is described as an operational accelerator. Something to be aware of is that the learning curve is steep if your team isn’t already familiar with Google Cloud. Cost and support response times are also flagged as concerns.
Our Take
If your organization is already invested in Google Cloud, SecOps will feel natural. The Gemini integration deepens the more of the ecosystem you’re using. We think teams running hybrid or multi-cloud environments where Google isn’t the primary provider will get less return on the integration layer. For Google-committed security teams operating at scale, this is a very strong option to consider.
Strengths
- Curated detections maintained by Google's threat research team reduce rule management overhead
- Gemini powers natural language search, case summaries, and playbook creation across the platform
- SOAR layer connects over 300 tools for complex multi-vendor response workflows
- Automatic entity stitching and alert graphing accelerate investigation without manual correlation
Cautions
- Reviews note a steep learning curve for teams without existing Google Cloud familiarity
- Customers flag cost and support response times as concerns at enterprise price points
Microsoft Security Copilot
Microsoft Security Copilot with Sentinel is an AI layer built across Microsoft’s security stack, designed to help SOC teams analyze incidents, generate queries, and accelerate response using natural language. We think it’s a strong fit for organizations already running Sentinel, Defender XDR, or both.
Microsoft Security Copilot Key Features
The natural language to KQL capability is the standout here, removing one of the biggest friction points for analysts who aren’t fluent in query language. The NL2KQL framework includes a Query Refiner that validates and repairs generated queries, ensuring syntactic and semantic correctness. The Security Analyst Agent, announced at Ignite 2025, helps analysts quickly identify, assess, and prioritize risks by performing deep, multi-step investigations across Defender and Sentinel telemetry. The UEBA behaviors layer is now generally available, summarizing clear, human-readable behavioral insights from high-volume raw security logs.
What Customers Say
Customers say the integration with Microsoft’s security ecosystem is the standout strength. Querying across the environment, getting context-aware incident summaries, and surfacing insights that would otherwise require manual investigation are consistently praised. Response time improvements get mentioned across team sizes. Something to be aware of is that the learning curve during initial adoption is real, with manual validation required early on.
Our Take
If your security operations run on Sentinel and Defender, your analysts should have access to this. The Copilot layer adds tangible speed to daily triage and investigation without forcing a tool change. We think organizations running fragmented, non-Microsoft environments will find the integration value harder to unlock. Security Copilot is available to Microsoft 365 E5 and E7 customers.
Strengths
- Natural language to KQL removes a key skill barrier for analysts investigating Sentinel data
- Security Analyst Agent performs deep, multi-step investigations across Defender and Sentinel
- UEBA behaviors layer now GA, summarizing human-readable behavioral insights from raw logs
- Embedded AI assistance supports existing workflows rather than adding a separate tool
Cautions
- Value is heavily ecosystem-dependent, with limited return outside a Microsoft-first security stack
- Reviews note a learning curve during initial adoption, with manual validation required early on
Cortex XSIAM
Cortex XSIAM is Palo Alto Networks’ AI-driven SOC platform, consolidating SIEM, XDR, SOAR, and threat intelligence into a single environment. We think it’s one of the most complete platforms in this space for enterprise security teams looking to replace fragmented tooling with one platform that covers detection, investigation, and response end to end.
Cortex XSIAM Key Features
The platform ingests triple the EDR telemetry of standard endpoints, enriches it with firewall logs, and runs 2,900+ ML models across 13,300+ detections. XSIAM achieved 100% technique-level detection in MITRE ATT&CK Round 6. AI compresses thousands of alerts into prioritized cases with full attack storylines, including root cause. XSIAM 3.0, launched in April 2025, expanded the platform from reactive to proactive security with exposure management and advanced email security. The agentic AI layer lets you deploy an AI workforce to plan, reason, and act on threats autonomously with enterprise guardrails.
What Customers Say
Customers consistently highlight noise reduction and automation as the platform’s core operational benefits. Single-console visibility across endpoints, network, and cloud gets called out as a meaningful improvement over multi-tool environments. False positive rates drop noticeably once the ML models have had time to tune. Something to be aware of is that complexity and cost are the two consistent friction points. Initial deployment requires skilled resources, and the learning curve is steep.
Our Take
If your organization runs Palo Alto across the stack and needs a platform that can handle serious alert volume, XSIAM is worth a serious evaluation. We think smaller teams or organizations without dedicated SOC engineering capacity will struggle to get full value from it. The consolidation value is real, but your team needs the resources and maturity to operate the platform effectively.
Strengths
- 100% technique-level detection in MITRE ATT&CK Round 6 with 13,300+ detections
- AI consolidates thousands of alerts into prioritized cases with full attack chain context
- XSIAM 3.0 adds proactive exposure management alongside reactive incident response
- Unit 42 managed services available for teams needing 24/7 expert coverage
Cautions
- Initial deployment and tuning requires skilled resources and significant time investment
- Customers note that cost is high relative to alternatives, making it difficult for smaller teams
Prophet Security AI
Prophet AI is an autonomous SOC analyst built specifically around SaaS-heavy enterprise environments. We were impressed by the investigation engine, which mimics how a human analyst actually works through a case, from planning the investigation to delivering remediation steps. Prophet AI raised $30 million in Series A funding in July 2025, led by Accel, with strategic investments from Amex Ventures and Citi Ventures following in February 2026.
Prophet Security AI Key Features
Every investigation is completed across four stages: alert summary, dynamic question planning, context gathering from SIEMs, data lakes, and security tools, then severity scoring and concrete remediation steps. Prophet AI investigates every alert, including lows and informational, which is a differentiator in this space. The Dig Deeper capability lets analysts ask follow-up questions across single or multiple investigations without switching tools. The adapt layer learns from analyst feedback continuously, improving accuracy over time. Over the past six months, the platform has performed over 1 million investigations, saving 360,000 hours of investigation time.
What Customers Say
Customers say the platform arrives ready to work on enterprise SaaS from day one, without the lengthy tuning period that typically precedes value from AI triage tools. Alert fatigue reduction and investigation speed are the most commonly cited operational improvements. Prophet AI reports 10x faster response times with 96% fewer false positives.
Our Take
We think Prophet AI fits best where SaaS sprawl is the core problem. The built-in context around enterprise applications gives it an edge that generic AI triage tools don’t have. If your threat surface is primarily SaaS and your analysts are spending meaningful time on repetitive triage, Prophet AI is well worth considering.
Strengths
- Investigates every alert including lows and informational, eliminating fatigue-driven blind spots
- Day-one SaaS context means faster time to value without extensive tuning
- Continuous learning from analyst feedback improves investigation accuracy over time
- 1 million+ investigations performed with 360,000 hours of analyst time saved
Cautions
- Reviews note that configuration and customization controls are less flexible than some teams require
ReliaQuest GreyMatter
ReliaQuest GreyMatter is an agentic AI security operations platform that connects telemetry across your entire security stack, from prevention and detection through to containment and response. We think it’s a strong fit for enterprise and mid-market teams running fragmented tooling who need unified visibility without replacing what they already have.
ReliaQuest GreyMatter Key Features
GreyMatter detects directly at the source, bypassing SIEM bottlenecks rather than routing everything through a central log store first. The platform leverages 6 agentic personas, 200+ agent skills, and 400+ AI tools across the security lifecycle. The Deployment Orchestrator pushes detections to all connected tools in a single click, and the platform targets five-minute containment from detection through response. Pre-built playbooks cover the most common scenarios across multiple architectures simultaneously. GreyMatter also covers digital risk protection across open, deep, and dark web monitoring.
What Customers Say
Customers consistently describe GreyMatter as a single pane of glass that actually works, consolidating SIEM, EDR, firewall, and identity tools without degrading performance. AI-driven incident summaries in plain language get called out repeatedly as a practical time-saver. Support quality is a recurring positive across multiple team sizes and sectors.
Our Take
If your team is spending more time managing tools than managing threats, GreyMatter is designed for exactly that problem. We think organizations with mature, multi-vendor stacks and the appetite to invest in proper onboarding will see the strongest return. The five-minute containment target represents a meaningful operational shift for teams currently handling Tier-1 and Tier-2 work manually.
Strengths
- At-source detection bypasses SIEM latency, surfacing threats faster across connected tools
- 6 agentic personas with 200+ skills and 400+ AI tools across the security lifecycle
- Pre-built containment playbooks allow host isolation and IP blocking in seconds
- AI incident summaries in plain language speed up analyst decision-making
Cautions
- Reviews note that advanced automation workflows have a steep learning curve and require meaningful setup time
Splunk Enterprise Security
Splunk Enterprise Security is a mature SIEM platform built for large enterprise SOC teams that need deep visibility, flexible detection, and scalable log correlation. Now part of Cisco, Splunk ES combines SIEM, SOAR, UEBA, and threat intelligence in a single platform backed by Cisco Talos. We think it remains one of the deepest detection platforms available for organizations with the resources to operate it.
Splunk Enterprise Security Key Features
The risk-based alerting model is the standout here. Rather than generating one alert per detection, it assigns weighted risk scores to entities over time, so analysts work prioritized cases built from correlated activity. Splunk claims up to 90% alert volume reduction for teams that tune it properly. MITRE ATT&CK integration lets analysts map detection coverage directly against the framework. Detection Studio and automatic versioning give detection engineers native version control and rollback capability. Cisco Talos threat intelligence is included at no extra cost.
What Customers Say
Customers consistently say that once Splunk ES is tuned, it becomes the most reliable central point for monitoring and investigations they’ve worked with. The Splunkbase ecosystem, with add-ons for CrowdStrike, Palo Alto, Okta, and Microsoft 365, significantly reduces normalization overhead. Something to be aware of is that initial deployment routinely requires third-party expertise, and data ingestion-based pricing escalates quickly as log volume grows.
Our Take
If your organization has the budget, the engineering capacity, and the alert volume to justify a platform of this depth, Splunk ES is worth serious evaluation. We think teams expecting fast time-to-value or running lean security functions will struggle. The correlation engine and risk-based alerting model are strong for high-complexity environments that need structured workflows and deep visibility.
Strengths
- Risk-based alerting correlates entity activity over time, reducing noise and surfacing real incidents
- MITRE ATT&CK integration maps detection coverage gaps and links directly to framework documentation
- Splunkbase ecosystem provides pre-built add-ons for most major security tools
- Cisco Talos threat intelligence included at no additional cost
Cautions
- Implementation consistently requires external expertise and extended timelines
- Data ingestion-based pricing escalates quickly as log volume grows across large environments
Stellar Cyber Open XDR
Stellar Cyber Open XDR is a unified security operations platform that merges SIEM, NDR, and XDR into a single environment, built specifically for lean security teams and MSSPs. We think the open, vendor-agnostic architecture is the core differentiator here; Stellar Cyber integrates with existing EDR, SIEM, and network tools without requiring you to replace them.
Stellar Cyber Open XDR Key Features
Unlike platforms that reward ecosystem loyalty, Stellar Cyber integrates with security tools across vendors and normalizes telemetry from networks, endpoints, cloud, and identity into a single correlated view. The implementation team builds parsers for tools not natively supported, which reduces a common integration blocker. The AI and ML correlation layer turns raw alerts into high-fidelity incidents, reducing alert fatigue without requiring manual rule maintenance. Stellar Cyber reports MTTD reduced by 8x and MTTR reduced by 20x, with analyst productivity improved by over 80% and false positives reduced by over 90%.
What Customers Say
Customers consistently highlight single-pane-of-glass visibility and the correlation engine as the platform’s most practical strengths. Teams moving from siloed tooling describe meaningful time savings during investigations. Onboarding gets positive marks, with the presales and implementation teams frequently called out. Something to be aware of is that integrating tools that aren’t natively supported takes significant time and skilled resources.
Our Take
If your team is managing security across multiple clients or running a small team that can’t support a large analyst workforce, the economics here make sense. For MSSPs, the multi-tenancy model is a real operational advantage. We think organizations that need deep customization of their detection logic immediately should factor in the integration and tuning timeline.
Strengths
- Vendor-agnostic open architecture integrates with any EDR, SIEM, or network security tool
- Multi-tenancy lets MSSPs manage multiple client environments from a single console
- AI and ML correlation reduces raw alerts to high-fidelity incidents without manual rule maintenance
- Built-in NDR, UEBA, and threat intelligence modules reduce the need for additional point solutions
Cautions
- Users report that integrating tools without native support takes time and skilled personnel
- Reviews note that reporting and visualization capabilities lag behind the core detection engine
How We Compared The Best AI SOC Platforms
We assessed each platform’s AI triage capabilities, including how alerts are ingested, deduplicated, and prioritized. We evaluated whether the AI layer filters false positives effectively, how investigation depth compares to manual Tier-1 analyst work, and whether the platform delivers actionable findings or requires significant analyst follow-up.
We tested integration breadth and deployment experience across each platform, looking at how many security tools connect natively, how quickly the platform begins delivering value after deployment, and how much tuning is required before triage accuracy becomes operationally reliable.
We reviewed verified customer reviews and independent analyst research to validate vendor claims around alert volume reduction, mean time to respond, and analyst time savings. We specifically looked for consistency between what vendors report and what security teams experience in production environments.
We conducted vendor briefings, reviewed technical documentation, and followed up on specific capability claims where customer feedback or testing raised questions. Where platforms offer agentic AI capabilities, we evaluated the transparency and auditability of AI decision-making, including whether analysts can follow the reasoning chain behind each triage action.
Expert Insights’ editorial and commercial teams operate independently. No vendor can pay to influence the testing, review, or ranking of their products. Our recommendations are based on hands-on evaluation, verified customer feedback, and independent research.
What To Look For In AI SOC Platforms
Choosing the right AI SOC platform depends on your team’s alert volume, existing security tooling, and how much analyst oversight you want to retain. These are the factors we think matter most when evaluating AI SOC platforms.
AI Triage Depth and Accuracy. The platform should investigate alerts at a level comparable to a trained Tier-1 analyst, not just apply rule-based filtering. Look for platforms that gather evidence across multiple data sources, build context around each alert, and deliver a clear severity assessment with supporting rationale. Dropzone AI and Prophet Security both investigate every alert at full depth, including low-severity and informational alerts that rule-based systems typically skip.
Transparency and Auditability. AI-driven triage decisions need to be explainable to the analysts who act on them. Your team should be able to follow the reasoning behind every triage decision, escalation, or dismissal, which matters for compliance, analyst trust, and tuning accuracy over time. Torq’s Socrates orchestrator and Dropzone AI’s glass box approach both surface full reasoning chains alongside their findings.
Integration Breadth. An AI SOC platform is only as effective as the data it can access, so evaluate how many of your existing security tools connect natively and how much configuration is required to reach operational coverage. Torq ships with 300 prebuilt integrations, while ReliaQuest GreyMatter detects at the source across connected tools without routing everything through a central log store first.
Ecosystem Fit. Several AI SOC platforms deliver their strongest value within a specific vendor ecosystem. Microsoft Security Copilot compounds with Sentinel and Defender XDR, CrowdStrike Charlotte AI is trained on Falcon telemetry, and Google SecOps integrates most deeply with Google Cloud. If your stack is heavily invested in one ecosystem, prioritize platforms that build on that investment. If your environment is multi-vendor, look at vendor-agnostic options like Stellar Cyber or ReliaQuest.
Autonomous Response Controls. Platforms that take automated containment actions need clear guardrails around what they can execute without analyst approval. Evaluate whether the platform allows you to set thresholds for autonomous action, whether analysts can review and approve before execution, and whether response actions are logged with full context. Cortex XSIAM’s agentic AI layer and Dropzone AI’s auto-containment both include human oversight mechanisms alongside their autonomous capabilities.
Time to Value. Some AI SOC platforms require weeks of tuning before triage accuracy becomes reliable. Others deliver operational value within days. Prophet Security reports day-one SaaS context without extensive pre-configuration, while Splunk Enterprise Security consistently requires third-party expertise during initial deployment. Factor your team’s available resources and deployment timeline into the evaluation.
The Bottom Line
Start your evaluation by mapping your alert volume, your existing security stack, and how much analyst time is currently consumed by repetitive triage work. Shortlist AI SOC platforms that integrate natively with your tooling and match your team’s capacity for deployment and ongoing tuning, then run a proof of concept against real alert data before committing.
Written By
Alex is an experienced journalist and content editor. He researches, writes, factchecks and edits articles relating to B2B cyber security and technology solutions, working alongside software experts.
Alex was awarded a First Class MA (Hons) in English and Scottish Literature by the University of Edinburgh.