Agentic Soc platform

Agentic SOC Platform helps security teams control alert floods by turning noisy signals into organized cases, evidence-backed investigations, threat-intelligence context,

Comment

Inspiration

Security teams are under constant pressure from alert floods, false positives, limited staffing, and disconnected security tools. Analysts may receive thousands of alerts from SIEMs, endpoint systems, cloud platforms, identity providers, and network sensors, while only a small number represent real incidents.

Handling these alerts often requires switching between multiple dashboards, manually collecting evidence, checking threat-intelligence sources, contacting other teams, and writing reports. This creates alert fatigue, slows response times, and makes it easier to miss important signals.

I also had a difficult time managing security floods while working with the backend, integrations, and other supporting systems. I found the right time to build a platform that brings this work together and helps security experts focus on investigation and decision-making instead of repetitive manual tasks.

What it does

Agentic SOC Platform provides a shared workspace for security operations teams to:

  • Ingest alerts from SIEM systems and webhooks
  • Correlate related alerts into actionable cases
  • Track artifacts and indicators of compromise
  • Generate AI-assisted investigation summaries and reports
  • Enrich IP addresses, domains, hashes, users, and assets
  • Run investigation and response playbooks
  • Collaborate through comments, discussions, and notifications
  • Extract reusable knowledge from completed investigations
  • Manage users, roles, API keys, LDAP authentication, and audit logs
  • Give CLI tools and AI agents controlled access to security workflows

The goal is to help teams move from alert overload to organized, evidence-based action.

How we built it

The frontend was built with React, TypeScript, Vite, and Ant Design. It includes dashboards, case management, alert triage, artifact views, enrichment workflows, playbook execution, user management, and audit views.

The backend was built with Django and Django REST Framework. It is organized into applications for cases, alerts, artifacts, enrichments, playbooks, knowledge, accounts, comments, attachments, audit logs, inbox notifications, realtime updates, webhooks, and agent APIs.

PostgreSQL stores application data, Redis supports caching and realtime communication, and RustFS provides S3-compatible object storage for attachments. Background workers execute agentic modules, case analysis, playbooks, and ELK actions.

The platform is packaged with Docker Compose for private deployment and supports custom Python modules, SIEM definitions, and playbooks.

Challenges we ran into

The biggest challenge was representing the real problems faced by security teams:

  • Large volumes of noisy and duplicate alerts
  • Alert fatigue and limited analyst time
  • Fragmented context across multiple security tools
  • Manual enrichment of indicators and affected assets
  • Slow handoffs between analysts, incident response, IT, and management
  • Difficulty tracking ownership, priority, deadlines, and status
  • Repetitive evidence collection and report writing
  • Inconsistent investigation decisions
  • Failed background jobs and unreliable automation
  • The need to automate actions without losing human approval and accountability

We also had to connect the frontend, backend, databases, storage, integrations, realtime updates, and background workers into one reliable system.

Accomplishments that we're proud of

We are proud to have built a unified investigation platform instead of another isolated alert dashboard.

The platform connects alerts, cases, artifacts, enrichments, playbooks, collaboration, knowledge, and audit history in one workflow. We are also proud that it supports both security analysts and AI agents while keeping permissions, human review, and auditability important parts of the design.

The modular architecture allows teams to add custom modules, SIEM definitions, playbooks, and integrations without changing the entire platform.

What we learned

We learned that security automation must be explainable, traceable, and useful to human analysts. An automated result should include evidence, confidence, source context, timestamps, and a clear history of the actions that produced it.

We also learned that a security platform is more than its interface. Authentication, permissions, integrations, migrations, storage, background workers, retries, realtime updates, observability, and audit logs are all essential to making the system dependable.

What's next for Agentic SOC Platform

Our next priorities are:

  • Improve alert deduplication and case correlation
  • Add stronger evidence provenance and confidence tracking
  • Improve worker health monitoring and failure recovery
  • Add safer approval gates for automated response actions
  • Expand SIEM, cloud, identity, and threat-intelligence integrations
  • Add saved searches, case templates, assignment queues, and SLA tracking
  • Improve knowledge retrieval with source provenance and feedback
  • Add stronger API contracts, integration tests, and frontend smoke tests
  • Make cloud and free-tier deployment easier for smaller security teams
  • Continue improving the platform based on feedback from security experts

Built With

Share this project:

Updates