-
-
home section
Inspiration
Security analysts often lose valuable time after an alert because investigation work is spread across many separate searches: authentication logs, VPN events, admin activity, endpoint signals, data access logs, and network traffic. A single suspicious user or IP can require many manual SPL queries before an analyst understands what happened.
BreachPilot was inspired by that problem. The goal is to turn early-stage security triage into a structured, MCP-powered investigation workflow for Splunk.
Instead of building a generic chatbot, BreachPilot acts like an incident commander. It takes an entity such as a user, IP address, or host, follows an investigation plan, collects evidence, builds a timeline, scores risk, and recommends response actions while keeping the analyst in control.
What it does
BreachPilot investigates suspicious security activity and produces an analyst-ready incident brief.
In the demo scenario, the analyst investigates:
jane.admin
BreachPilot identifies a chain of suspicious activity:
Multiple failed logins
→ Successful login from the same suspicious IP
→ VPN activity from an unusual location
→ Admin console access
→ Sensitive customer export request
→ Suspicious network egress
→ Service error spike
The output includes:
- Incident severity and risk score
- Chronological attack timeline
- Evidence cards grouped by signal type
- Recommended analyst response actions
- Transparent MCP/SPL-style investigation steps
- Raw event context for verification
The main value is speed and explainability. BreachPilot helps analysts move from alert to evidence-backed decision faster, without hiding the reasoning process.
How we built it
BreachPilot is built as a web-based security investigation console.
The frontend is a Vercel-hosted dashboard that lets the analyst enter an entity and run an investigation. The backend API runs the investigation workflow, loads relevant security events, correlates the evidence, calculates a risk score, and returns a structured incident brief.
The project includes a synthetic Splunk-style dataset so judges can test the workflow immediately without needing a live Splunk instance. The repository also includes a Splunk/MCP integration path and scoped SPL-style queries to show how the same workflow maps to Splunk data through the MCP Server concept.
The architecture is:
Analyst
→ BreachPilot Web Console
→ Investigation API
→ Agent Workflow Engine
→ MCP Client Adapter
→ Splunk / Demo Security Events
→ Timeline, Evidence, Risk Score, Response Plan
The investigation workflow is intentionally human-in-the-loop. BreachPilot does not just return a final answer. It shows the investigation steps, evidence, and queries so the analyst can verify the result.
Use of Splunk MCP Server
BreachPilot is designed around the Splunk MCP Server idea: connecting AI agents to Splunk data through controlled tool calls.
The agent workflow uses MCP-style investigation steps to:
- Plan the investigation.
- Run scoped Splunk-style searches.
- Retrieve relevant events.
- Correlate signals across log sources.
- Produce contextual insights.
- Recommend response actions.
This makes the project a focused demonstration of agent-driven security operations with Splunk data.
Challenges we faced
The main challenge was keeping the project realistic while making it easy for judges to test. A real SOC workflow depends on many log sources and a configured Splunk environment, but a hackathon demo must work quickly and reliably.
To solve this, BreachPilot supports a demo mode with synthetic Splunk-style logs, while keeping the architecture ready for real Splunk MCP integration.
Another challenge was making the AI workflow transparent. Security analysts need to trust evidence, not just generated summaries. For that reason, BreachPilot shows the timeline, evidence cards, recommended actions, and SPL-style investigation steps instead of hiding everything behind a chat interface.
What we learned
This project showed how agentic workflows can improve security operations when they are structured, scoped, and explainable.
We learned that the best use of AI in SOC triage is not replacing analysts. It is helping analysts ask the right questions faster, collect the right evidence faster, and make better decisions with clear context.
What's next
Future improvements include:
- Real Splunk MCP Server connection in production mode
- Support for more log sources and indexes
- Saved investigation reports
- Detection rule generation
- Analyst feedback loop for scoring improvements
- Slack or ticketing system integration
- Expanded incident types such as malware, insider risk, cloud abuse, and service anomalies
Log in or sign up for Devpost to join the conversation.