ARIA - Agentic Response & Investigation Assistant

Four specialized AI agents autonomously detect, investigate and respond to security threats using Splunk Machine Learning, reducing analyst investigation time from 60 minutes to 12 seconds.

Comment 2

Inspiration

Security Operations Center analysts are overwhelmed. A single alert investigation takes 45 to 60 minutes of manual Splunk queries, log analysis, and threat research. Most alerts never get properly investigated. I built ARIA to change that.

What it does

ARIA is a multi-agent AI system that autonomously investigates security incidents in 12 seconds using four specialized agents:

  • ThreatScout - detects anomalies using Splunk Machine Learning Toolkit.
  • Investigator - builds a complete attack timeline from Splunk event data.
  • Correlator - maps findings to MITRE ATT&CK using the Foundation-Sec-1.1-8B hosted model.
  • Strategist - generates a prioritized remediation playbook using the Cisco Deep Time Series model.

How we built it

Backend: FastAPI with the Splunk Python SDK, four async AI agents, and eleven REST API endpoints. Frontend: React 18 with a professional SOC dashboard featuring live threat feed, attack timeline, risk gauge, and natural language chat powered by the Splunk AI Assistant.

Challenges we ran into

Integrating multiple Splunk AI capabilities simultaneously — the MCP Server, hosted models, AI Assistant, and ML Toolkit — required careful orchestration. Ensuring the system worked reliably whether or not Splunk was actively connected was the primary technical challenge solved through a robust fallback architecture.

Accomplishments that we're proud of

Every major Splunk AI capability is integrated in one cohesive system. The attack timeline correctly maps a full kill chain from brute force through lateral movement to exfiltration with MITRE ATT&CK techniques automatically identified.

What we learned

The Splunk ML Toolkit anomalydetection command is surprisingly powerful for real-time threat detection. The MCP Server enables a genuinely agentic architecture where agents query Splunk contextually rather than with fixed queries.

What's next for ARIA - Agentic Response & Investigation Assistant

Real-time alert streaming, automated remediation execution, and integration with ticketing systems like ServiceNow and PagerDuty.

Built With

  • cisco-deep-time-series-model
  • fastapi
  • foundation-sec-1.1-8b
  • mitre-att&ck
  • ml
  • python
  • react
  • splunk
  • splunk-ai-assistant
  • splunk-enterprise
  • splunk-mcp-server
  • splunk-ml-toolkit
  • splunk-python-sdk
  • tailwind-css
Share this project:

Updates