Sentinel-MCP: The Autonomous SOC Orchestrator

Splunk Dashboard
Architectural/Flow Diagram
Server logs showinf our agent reasoning capabilities.

Inspiration

Security Operations Center (SOC) analysts are currently facing a crisis of Alert Fatigue. With 90% of security alerts being false positives, the "Mean Time to Respond" (MTTR) is far too slow—often taking 45 minutes or more to investigate a single suspicious login. We were inspired to create a solution where the logs don't just sit in a dashboard waiting for a human; they trigger an autonomous teammate that performs the investigation for you.

What it does

Sentinel-MCP is an autonomous AI agent designed for Agentic Ops. When Splunk Cloud detects a high-risk event (like a suspicious login), Sentinel-MCP wakes up and initiates a multi-step forensic investigation:

Autonomous Investigation: It uses the Splunk API as a tool to "pivot" through logs, looking for patterns across IPs and users.
Organizational Context: It cross-references technical logs with an HR database to see if the user is on vacation or holds a sensitive role (e.g., Finance Lead).
Threat Intel Correlation: It checks source IPs against global reputation databases (simulated) to find high-fidelity indicators like Tor Exit Nodes.
Interactive Remediation: It delivers a full forensic report to Slack with a "Verdict." A human admin can then "Isolate" the user with one click, which automatically updates the Splunk audit trail and notifies the HR department in a separate secure channel.

How we built it

The Brain: We used Llama 3.1 8B (via Hugging Face/Router) as the reasoning engine, allowing the agent to decide which tools to call.
The Logic: We built a custom Agentic Loop using LangChain, allowing the AI to perform "chain of thought" reasoning over forensic data.
The Data: Splunk Cloud acts as our source of truth. We used the Splunk Python SDK to build "MCP-style" tools that the AI can use to query logs dynamically.
The Workflow: FastAPI handles inbound webhooks from Splunk, while the Slack SDK and Block Kit create the interactive "Command Center" for the SOC team.
Deployment: The entire solution is containerized using Docker for consistent environment management.

Challenges we ran into

Connectivity: Bridging the gap between a local development environment and Splunk Cloud API required careful management of tokens and IP whitelisting.
Reasoning Reliability: Ensuring the LLM didn't "hallucinate" SPL (Splunk Processing Language). We solved this by using the Splunk AI Assistant to help refine the tool-calling logic.
Slack Permissions: We encountered "scope" and "channel membership" hurdles when trying to enable the bot to talk across different department channels (Security vs. HR), which taught us a lot about the Slack OAuth ecosystem.

Accomplishments that we're proud of

End-to-End Autonomy: We successfully moved from a "Passive Alert" to an "Active Agent." The agent actually performs the research before a human even sees the notification.
Organizational Ripple Effect: We are proud of how the agent bridges silos—notifying HR automatically the moment a security isolation occurs.
Forensic Synthesis: Creating an AI that can summarize complex logs into a "Verdict" and "Forensic Breakdown" that is actually useful for a human decision-maker.

What we learned

We learned that the most powerful part of Splunk isn't just the data it stores, but the speed of the API. We also learned that Agentic Ops is less about "replacing" humans and more about "augmenting" them—giving a junior analyst the tools and context of a senior engineer through an AI interface.

What's next for Sentinel-MCP: The Autonomous SOC Orchestrator

Production APIs: Integrating real-world Threat Intel feeds like VirusTotal and CrowdStrike.
Self-Healing Actions: Allowing the agent to automatically disable users in Active Directory or block IPs at the firewall level once high-confidence thresholds are met.
Multi-User Correlation: Developing the agent's ability to "think" across multiple users to detect complex lateral movement or "Low and Slow" attacks.
Splunk App Marketplace: Packaging the Sentinel-MCP agent as a formal Splunk App to make it accessible to every enterprise.