Amygdala — Autonomous SOC Analyst

Inspiration

Security Operations Centers are drowning. The average SOC team receives 11,000+ alerts per day, and analysts spend over 25 minutes triaging each one. Most turn out to be false positives. The result? Alert fatigue, burnout, and real threats slipping through the cracks.

We asked ourselves: What if the triage process itself was autonomous? Not a dashboard. Not another SIEM rule. An actual agentic system that thinks like a Tier 1 analyst — correlating events, tracing lateral movement, scoring risk — and only escalates when a human genuinely needs to act.

The name Amygdala comes from the part of the brain responsible for threat detection. It processes danger signals before conscious thought kicks in. That's exactly what we built for the SOC: a threat detection center that never sleeps, never gets fatigued, and processes alerts in seconds instead of minutes.

When Splunk released Foundation-Sec-1.1-8B and the MCP (Model Context Protocol) server, we saw the perfect opportunity — a security-specialized LLM with native Splunk connectivity. The pieces were there. We just had to wire them into an autonomous agent.

What it does

Amygdala is a fully autonomous alert triage and investigation pipeline that:

Ingests alerts from Splunk via MCP server using token-based auth and SPL queries
Triages threats using Foundation-Sec-1.1-8B — Splunk's security-specialized LLM — assigning severity scores (1–10) and threat categories
Spawns investigation sub-agents that run concurrently to:
- Correlate related events by source IP, user, and host
- Check indicators against threat intelligence feeds (VirusTotal, AbuseIPDB)
- Build chronological event timelines
- Trace attacker lateral movement across the environment
Calculates composite risk scores using the formula.
Generates structured incident reports in dual format — JSON for automation and human-readable summaries for Slack
Delivers reports to Slack channels or custom webhooks in real-time
Escalates only when necessary — configurable thresholds ensure humans only see what requires human judgment

The entire pipeline runs in seconds. Zero human-in-the-loop unless the escalation threshold is hit.

How we built it

Architecture: Pipeline-based async Python system with discrete, composable stages.

Splunk → MCP Server → AlertIngestor → TriageAgent (Foundation-Sec LLM)
    → InvestigateAgent (concurrent sub-agents) → ReportBuilder → OutputHandler (Slack)

Key technical decisions:

Async-first (asyncio + httpx): Alerts are processed concurrently. Investigation sub-agents run in parallel via asyncio.gather() for maximum throughput.
MCP as transport layer: Instead of building a custom Splunk connector, we use Splunk's MCP server for standardized tool calls (splunk_search, threat_intel_lookup). This keeps us protocol-compliant and forward-compatible.
Foundation-Sec-1.1-8B for triage: We use Splunk's security-specialized LLM rather than a generic model. It understands security context — MITRE techniques, attack patterns, severity nuances — out of the box.
Structured JSON output from LLM: The triage agent requests JSON-formatted responses with a strict schema (severity, category, summary, recommended_action), then validates and clamps values.
Graceful degradation: If the model endpoint is down, the system falls back to heuristic-based triage using alert metadata. If IOC feeds are unavailable, investigation continues without them. One failed alert never crashes the pipeline.
Retry with exponential backoff: MCP client retries failed requests up to 3 times with 1s/3s/5s backoff.
Demo mode: A --demo flag processes 5 realistic attack scenarios (port scan → brute force → lateral movement → malware → privilege escalation) with simulated LLM responses, so anyone can run the full pipeline without Splunk credentials.

Stack: Python 3.12, httpx, pydantic, slack-sdk, pyyaml, python-dotenv, pytest. Fully containerized with Docker.

Challenges we ran into

LLM response parsing: Foundation-Sec doesn't always return clean JSON. We had to build a robust extraction layer that handles markdown code blocks, extra text around JSON objects, and partial responses. The _extract_json() method searches for JSON objects using multiple strategies.
Concurrent investigation without race conditions: Running correlation, IOC lookup, and timeline building in parallel required careful handling of asyncio.gather() with return_exceptions=True so one failing sub-agent doesn't kill the others.
Alert normalization: Splunk alerts come in wildly different formats depending on sourcetype and field extractions. We built a normalization layer that maps 15+ possible field names (src_ip, src, source_ip, etc.) to a consistent schema.
Making it demo-able: Hackathon judges can't spin up a Splunk instance. Building a realistic demo mode with simulated attack chains, correlated events, and IOC matches was essential — and surprisingly complex to make convincing.
Risk scoring that's meaningful: Designing a composite risk formula that balances severity, correlation density, and IOC matches without being overly simplistic or gaming-prone required iteration.

Accomplishments that we're proud of

Full autonomous pipeline — from raw SPL query to Slack report in seconds with zero human interaction
56 passing tests covering triage, investigation, reporting, output, MCP client, and demo mode
Dual-format output — structured JSON for downstream automation plus rich Slack messages for humans
Attack chain simulation — the demo mode tells a coherent story (reconnaissance → credential attack → lateral movement → malware → privilege escalation)
Production-ready error handling — retry logic, graceful degradation, per-alert isolation (one bad alert can't crash the pipeline)
Open source from day one — full community infrastructure (CONTRIBUTING, SECURITY, CODE_OF_CONDUCT, ROADMAP, CHANGELOG, GitHub Actions, GitHub Pages site)
The triage agent's fallback system — when the LLM is unavailable, it uses severity hints from the alert metadata to estimate risk rather than failing silently

What we learned

Security-specialized LLMs outperform general models for threat classification. Foundation-Sec understands attack context that GPT-4 would miss or hallucinate on.
MCP is the right abstraction for SIEM connectivity. Tool-based calls (splunk_search) are cleaner than raw REST APIs and more maintainable.
Agentic architecture > monolithic prompts. Breaking the problem into triage → investigate → report with separate agents produces more reliable results than one giant prompt trying to do everything.
Demo mode is not optional for security tools. You can't ask people to expose their Splunk instance to evaluate your project.
Alert fatigue is a UI problem and a processing problem. Even the best dashboard fails if the underlying data isn't pre-filtered by an intelligent system.

What's next for Amygdala

IOC feed integration — VirusTotal, AbuseIPDB, OTX AlienVault for real-time indicator enrichment
MITRE ATT&CK mapping — auto-tag alerts with technique IDs (T1110, T1021, etc.) for standardized reporting
Analyst feedback loop — SOC analysts can confirm/reject triage decisions, and the system learns from corrections
Multi-SIEM support — Elastic Security, Microsoft Sentinel, and Sumo Logic via additional MCP adapters
Streaming mode — replace polling with real-time alert streaming for sub-second response times
Fine-tuning pipeline — use organization-specific alert history to tune Foundation-Sec for your environment's noise patterns
Dashboard UI — web interface for reviewing triage decisions, investigation timelines, and escalation history