Argus

The autonomous SOC analyst for Splunk: it writes its own SPL via the MCP Server, maps MITRE ATT&CK, and contains threats with every verdict grounded in real events.

Comment

🛡️ Inspiration

A Tier-1 analyst spends 30–60 minutes triaging a single Splunk alert, and the queue never ends. Pointing an LLM at it only helps if the verdict can be trusted, and "true positive, severity high" is worthless without the evidence behind it.

Argus is built around that constraint. It is an autonomous SOC analyst for Splunk with one rule: every material claim is grounded in real Splunk evidence, linked back to the exact SPL it ran and the events it used. It reads Splunk only through the Splunk MCP Server, which keeps the whole investigation auditable, portable, and reusable.

🔭 What it does

Given an alert (or a natural-language request), Argus:

  1. Recalls its own memory — checks past cases and the active blocklist for any indicator already named in the alert, the way a veteran analyst remembers a repeat offender.
  2. Investigates autonomously — a real plan → act → observe → re-plan loop. Claude writes its own SPL, runs it via splunk_run_query on the MCP Server, reads the real results, and decides the next pivot.
  3. Reasons in the open(Thinking) — an explicit hypothesis ledger declares leading theories up front and marks each confirmed / refuted as evidence lands, so it tests alternatives instead of confirming its first guess.
  4. Correlates as a team (--multi) — four specialists (auth, network, endpoint, threat-intel) investigate concurrently and a synthesizer fuses them into one attack narrative.
  5. Produces a grounded report — verdict, severity, confidence, attack timeline, IOCs, validated MITRE ATT&CK mapping rendered as an ordered kill-chain, and a composite risk score (0–100)
  6. Acts (--respond) — writes offending indicators to a Splunk KV-store blocklist that a correlation search enforces against live data, opens Slack/Jira, all behind a human-approval gate.
  7. Self-hardens — after a confirmed true positive it writes a new read-only SPL detection and installs it as a real scheduled Splunk correlation search. Argus doesn't just close the incident — it leaves behind the detection that catches the next one.

On the BOTS v3 dataset it autonomously finds the real Frothly AWS compromise which was the leaked access key AKIAIGKL572SFDPOKLHA, the compromised web_admin identity, attacker IP 139.198.18.205 across ~17 self-authored queries, then contains it.

How we built it

A Python async orchestrator runs a custom Claude tool-use loop (Claude Sonnet 4.6 on AWS Bedrock). All investigation reads go through the Splunk MCP Server (Splunkbase 7931) over JSON-RPC, running real SPL against live Splunk every run — nothing is mocked. Response writes use Splunk's authenticated REST API, so the analysis path stays read-only and MCP-native while actions stay explicit and gated. Deterministic post-processing validates MITRE technique ids against a pinned ATT&CK catalog and computes the risk score, so the trustworthy parts can't be hallucinated.

Argus also ships as reusable infrastructure: a CLI, a streaming web dashboard, an Argus MCP server so other copilots can call it, and a Splunk custom alert action so a saved search can trigger it. All of it runs live in the cloud — the dashboard on Vercel, the agent + Splunk co-located on a VPS behind HAProxy/TLS, and a hosted, token-gated read-only MCP endpoint other hosts can connect to directly.

Challenges We Faced

A failing benchmark turned out to be wrong, not the agent: a "malicious" ground-truth IP was actually Splunk's own benign data-collection account. We fixed the metric instead of forcing the agent toward a false positive, and made that a core principle.

Pulling decisive evidence from raw XML-heavy Sysmon data in BOTS v3 took better extraction tradecraft plus a confidence-gated continuation, so the agent finishes a close-but-not-decisive pivot.

Real integration friction: MCP tokens only work when minted with audience=mcp, and the web stream needed exact SSE framing plus disabled Next.js compression before events would render.

🎓 What we learned

  • Grounding is the product. Without evidence links, security AI isn't trustworthy enough to use.
  • A failing metric can indicate a data problem, not an agent problem.
  • Benign verdicts must be first-class successful outcomes, or the system over-calls.
  • Strong constraints buy trust: keep investigation MCP-native and read-only, and gate every write.

🚀 What's next

  • Move from exact-match case recall to semantic recall.
  • Broaden the detection-replay evidence.
  • Calibrate risk-score weights against labeled incident-priority data.
  • Harden the hosted MCP for multi-tenant use: per-org Splunk connections and scoped, OAuth-issued tokens instead of a shared demo bearer.
  • Stream live investigation progress over MCP so a connected host can watch Argus reason, not just receive the final report.

Hosted MCP bearer token (verified live on the gateway): c37a0050754369304a856aa68356c22d481b4c937ece6d6b418c35fcb74ceaa6

Built With

  • abuseipdb
  • anthropic-claude
  • aws-bedrock
  • boto3
  • botsv3
  • claude-sonnet-4.6
  • fastapi
  • geist
  • gsap
  • ip-api
  • jira-rest-api
  • json-rpc
  • mitre-att&ck
  • model-context-protocol
  • next.js
  • pydantic
  • python
  • react
  • server-sent-events
  • slack-webhook
  • spl
  • splunk
  • splunk-kv-store
  • splunk-mcp-server
  • splunk-rest-api
  • sse-starlette
  • tailwindcss
  • typer
  • typescript
  • uv
  • uvicorn
  • virustotal
Share this project:

Updates