Inspiration
SOC analysts average 500+ alerts per day. The most dangerous attacks like credential stuffing and lateral movement are specifically designed to stay below alert thresholds. No single rule catches them. I wanted to build something that hunts proactively, the way a skilled analyst would: form a hypothesis, find evidence, revise, decide.
How I built it
Agent core — Python handles hypothesis generation, SPL query writing, evidence evaluation, confidence scoring, and orchestration.
Splunk integration — Splunk Python SDK connecting to a local Splunk Enterprise instance with a synthetic 3-day attack dataset.
AI reasoning — Claude Opus 4.8 via Anthropic API handles every reasoning step with retry logic and exponential backoff.
Backend — FastAPI with Server-Sent Events streaming live agent reasoning to the dashboard in real time.
Frontend — React and Vite SOC dashboard with live confidence meters, reasoning stream, and confirmed threat cards.
Challenges I ran into
The hardest problem was making the agent reason like an investigator rather than just summarize. Early versions would form a hypothesis and accept weak evidence. The breakthrough was structuring the prompt to force the agent to ask whether the evidence actually confirms or denies the hypothesis. That produced genuine confidence revision in both directions. Building realistic synthetic data was also tricky — benign users needed stable IPs so attacker IP rotation would actually stand out as a signal.
Accomplishments that I'm proud of
Building the entire project solo — from zero Splunk knowledge to a fully working autonomous threat hunting agent in a few days. The moment that felt most real was watching the agent correctly dismiss a false positive on its own, recognizing that bob and erin were legitimate users mistyping passwords rather than attackers. That was not scripted. The agent genuinely reasoned its way to the right conclusion.
What I learned
How to build a true agentic loop where the model drives decisions about what to investigate next rather than just chaining API calls. The difference between a tool that summarizes alerts and one that genuinely hunts is entirely in the quality of the reasoning loop.
What's next for Sentinel
Connect to live Splunk Cloud instances, add more hypothesis types like ransomware staging and data exfiltration detection, and build multi-tenant support for enterprise SOC teams.
Log in or sign up for Devpost to join the conversation.