Feed your SIEM alerts to an open-source AI investigator

What it does

Agentic SOC Platform is an open-source, Python-based security operations platform that ingests alerts from multiple backends—ELK, Splunk, and others—through a unified YAML configuration. It correlates IOCs, enriches them with external threat intelligence, and uses LLMs to generate structured investigation reports with verdicts and remediation advice. Playbooks and a module framework, all pure Python, handle automation, while a knowledge base accumulates reusable findings from closed cases.

The interesting bit

The platform integrates with Claude Code via the MCP protocol, letting an AI agent operate cases, search logs, and even write new modules without leaving the chat interface. That turns the SOC analyst workflow into something closer to pair-programming with a security-savvy copilot.

Key highlights

• Correlates alerts across ELK, Splunk, and other SIEMs from a single YAML config.
• Auto-enriches artifacts with reputation scores and malware context from threat-intel providers.
• Generates structured investigation reports—verdicts, attack chains, IOCs—via LLM.
• Playbooks and modules are pure Python, MIT-licensed, and designed to run fully on-premise.
• Integrates with Claude Code through MCP for agent-driven case operations and module authoring.

Caveats

• The README reads like a product brochure: it touts “99% noise reduction” and “seconds not hours” without benchmarks or architectural detail to back them up.
• It lists LangChain, LangGraph, and Dify in repository topics, but the README never explains how—or whether—they are actually wired into the stack.
• The deep code-agent integration is specifically tied to Claude Code and the MCP protocol, so that feature appears locked to Anthropic’s ecosystem for now.

Verdict

Worth a look if you run a SOC and want an on-premise, Python-native layer to automate alert triage. Skip it if you need to see detailed architecture docs or proof of those “99%” claims before installing anything.