PathGuard AI

Inspiration

Security teams receive thousands of alerts every day, but alerts alone rarely explain business impact. Analysts often need to manually correlate identities, endpoints, applications, databases, and network activity across multiple security tools before understanding whether an alert is actually dangerous. We built PathGuard AI to solve this problem. Instead of showing isolated alerts, PathGuard transforms security telemetry into attack paths that explain how an attacker could move through an environment, what assets are at risk, and what actions should be taken next.

What it does

PathGuard AI is an AI-powered security investigation platform that connects to Splunk Enterprise through the official Splunk MCP Server. The system ingests alerts, authentication events, endpoint telemetry, identity relationships, network connections, and asset inventory data from Splunk. It then builds a graph representation of the environment and automatically identifies potential attack paths. For every investigation, PathGuard provides:

• Attack path visualization
• Blast radius analysis
• Business impact assessment
• Risk scoring
• Affected assets
• Recommended response actions
• AI-generated analyst summaries Instead of asking analysts to manually correlate events, PathGuard performs the investigation automatically and presents the findings in a clear, actionable format.

How we built it

PathGuard was built using:

• Splunk Enterprise
• Official Splunk MCP Server (App 7931)
• Python
• FastAPI
• NetworkX
• HTML/CSS/JavaScript
• REST and MCP integrations
• Graph-based attack path analysis Security data is stored in Splunk under the pathguard index using dedicated security sourcetypes. PathGuard queries Splunk through the official MCP Server, retrieves relevant security events, normalizes the data into a graph model, identifies relationships between identities and assets, and generates investigation results.

Challenges we ran into

One of the biggest challenges was converting raw security events into meaningful attack paths. Security logs are often isolated and disconnected. We needed to correlate identities, endpoints, applications, databases, and network activity into a unified graph structure that could accurately represent attacker movement. Another challenge was integrating with the official Splunk MCP Server while maintaining compatibility with traditional Splunk REST APIs for fallback scenarios.

Accomplishments that we're proud of

• Successfully integrated with the official Splunk MCP Server
• Built end-to-end investigations using real Splunk Enterprise data
• Created graph-based attack path analysis
• Automated blast radius and business impact assessment
• Developed an intuitive analyst-focused investigation interface
• Implemented real Splunk-backed security investigations instead of mock-only demonstrations

What we learned

This project reinforced how difficult security investigations become when data exists in isolated silos. We learned that graph-based analysis can significantly improve analyst understanding by connecting alerts to the business systems they affect. We also gained hands-on experience integrating AI workflows with the official Splunk MCP ecosystem.

What's next for PathGuard AI

Future improvements include:

• MITRE ATT&CK mapping
• Multi-stage attack detection
• Automated remediation workflows
• Additional Splunk integrations
• Real-time streaming investigations
• Natural-language analyst interaction through MCP agents Our goal is to evolve PathGuard into an AI-powered security copilot that helps analysts understand risk, prioritize incidents, and respond faster.

Built With

• ai
• css
• cybersecurity
• fastapi
• graph-analytics
• html
• javascript
• mcp
• networkx
• official-splunk-mcp-server
• python
• rest-apis
• splunk-enterprise