What it does
Protocol SIFT Agent is an autonomous incident-response pipeline that triages Windows Event Logs for brute-force activity — and catches its own false positives before reporting them. It parses raw '.evtx' evidence, flags suspicious failed-logon patterns, then independently verifies each finding and retracts the ones that don't hold up. Every conclusion traces back to specific event records.
Inspiration
The hardest problem in triage isn't missing an attack — it's confidently reporting one that isn't there. A handful of failed logins looks identical to a brute-force attack until you inspect why each one failed. I wanted to build a triage agent that doesn't just detect, but interrogates its own conclusions.
How I built it
The pipeline has three stages:
- Parse — converts raw event logs into structured records using SIFT's 'evtx_dump.py', keeping each event's 'EventRecordID' so every finding stays traceable.
- Naive detector — a deliberately high-recall pass that counts all failed-logon clusters and flags them. It does not try to be clever.
- Independent verifier — re-examines the raw records behind each finding, separates genuine credential failures from system/service noise, and re-issues a corrected verdict.
It runs on the SANS SIFT Workstation and is built to be driven by Claude Code as the agentic execution engine, with an orchestrator that runs the full sequence and writes timestamped execution logs.
The key design decision was splitting detection from verification. Instead of one "smart" detector, the system casts a wide net first, then prunes false positives in a separate, auditable layer — making self-correction an architectural property rather than a prompt instruction the model might ignore.
Challenges I ran into
The test data hid a perfect trap: a sample with ten failed logins from a single IP looks like textbook brute force, but eight were SQL Server internal certificate accounts — routine system noise. A naive detector confidently reports an attack that isn't real. Solving this correctly — rather than just suppressing the alert — is what drove the two-layer architecture.
What I learned
Placing intelligence in a dedicated, inspectable verification stage is more trustworthy than a single opaque detector. I also learned the value of documenting a tool's weaknesses honestly — in incident response that matters more than a clean-looking demo.
What's next
The parser/detector/verifier pattern extends naturally to other techniques — lateral movement, privilege escalation, credential dumping — each as an additional detector behind the same verification layer. Tighter Protocol SIFT agent-loop integration and broadened noise-classification rules are the next steps.
Log in or sign up for Devpost to join the conversation.