Inspiration

AI-driven attacks can compromise a network in minutes. Most incident response tooling — SIEM integrations, SOAR platforms, enterprise correlation engines — assumes an organization already has a security stack to plug into. We researched what's actually out there: Slack's own Anomaly Event Response, incident.io, Rootly, FireHydrant, mature AI SOC platforms. Every one of them is built the same way — layered on top of monitoring tools and budgets an organization already has.

That's the gap.

A 15-person nonprofit, a small clinic, a school IT department has none of that. When something suspicious happens, they have nothing. We built SecureShift for that blind spot specifically.

What it does

• /triage <text> — paste a suspicious log line, email, or alert. Get back severity, plain-English explanation, extracted incident details (time, source, attempt count, outcome), a clear recommended action, and free escalation resources.
• Message shortcut — right-click any message already in Slack, triage it instantly.
• MITRE ATT&CK mapping via MCP — every finding is reasoned against real ATT&CK techniques through a dedicated MCP (Model Context Protocol) server — a genuinely separate process the agent connects to, not a function call dressed up as an integration.
• Auto-escalation — HIGH/CRITICAL findings automatically create a dedicated #incident-<timestamp> channel with the full report pinned.
• Repeat-source memory — flags when the same IP or account has been reported multiple times.
• Cross-report correlation — the feature we're most honest about. Alert correlation itself is a mature, well-established SOC capability — nothing new there. But Proofpoint's 2026 survey of 1,400+ security professionals found 41% struggle specifically to correlate threats across collaboration channels, because enterprise correlation tools read structured telemetry, not a casually-typed Slack message from someone who isn't a security professional. SecureShift correlates that layer instead: two people, two different channels, two different phrasings, potentially the same incident — flagged automatically, with the shared indicator (same IP, domain, sender) surfaced when one genuinely exists in both reports.

How we built it

Slack Bolt SDK in Socket Mode — no public server required, a real constraint for organizations without infrastructure to maintain. Groq's Llama 3.3-70b handles severity reasoning, structured detail extraction, and correlation analysis. MITRE lookup runs through a standalone MCP server our agent connects to as a client. Incident memory persists in SQLite with thread-safe access across Bolt's worker threads. Auto-escalation uses Slack's own conversations.create and pins.add.

Challenges we ran into

We initially attempted a Real-Time Search API integration through Slack's new AI Assistant thread framework. After extensive debugging — confirmed scopes, updated event subscriptions, the latest slack-bolt version, even testing Slack's own official template repository unmodified — we determined this beta feature wasn't reliably firing events in our sandbox. We pivoted to MCP server integration instead, which we could build and fully control ourselves.

We also hit real engineering bugs along the way: a SQLite threading violation from Bolt's worker-thread model, Groq occasionally returning a single JSON object instead of an array when only one technique matched, and a reminder that LLM output needs defensive parsing at every layer, not blind trust.

What we learned

The most valuable lesson wasn't technical. Before assuming any piece of this was unprecedented, we researched what already existed — twice, for two different features. We weren't first at either. Auto-escalation is a mature SaaS pattern. Alert correlation is a decade-old, billion-scale-proven SOC capability. That research reshaped the pitch honestly: SecureShift's value isn't "more advanced than the incumbents" — it's "built for, and correlating the specific data of, the organizations incumbents structurally can't reach."

What's next for SecureShift

• Revisit RTS API integration once Slack's AI Assistant framework stabilizes out of beta
• Free IP reputation lookups to reduce reliance on the LLM's own judgment alone
• A weekly digest command summarizing incidents for teams with no dashboard
• Expand correlation beyond 48-hour windows with configurable lookback

Built With

• ai-agent
• automation
• cybersecurity
• generative-ai
• groq
• incident-response
• mitre-att&ck
• model-context-protocol(mcp)
• python
• security-triage
• slack-bolt-sdk
• slack-real-time-search-api
• socket-mode
• sqlite