SentinelAgent

Inspiration

What it does

How we built it

Challenges we ran into

Accomplishments that we're proud of

What we learned

What's next for SentinelAgent

Inspiration

Security operations teams face alert fatigue -- hundreds of alerts per day, many of which are low-fidelity noise. Analysts spend hours manually correlating events, looking up asset context, and writing triage reports. We built SentinelAgent to automate that entire workflow: from raw Splunk alert to a structured triage report, with zero human intervention in the loop.

What it does

SentinelAgent is an autonomous alert triage agent that:

1. Receives a security alert (brute force, suspicious process, data exfiltration, etc.)
2. Connects to Splunk via the official Splunk MCP server to run contextual SPL queries
3. Uses Foundation-sec (Splunk's security-domain foundation model via the saia_generate_spl MCP tool) to generate targeted SPL and classify threat severity
4. Falls back to Claude (claude-sonnet-4-6) when Foundation-sec is unavailable
5. Builds a complete investigation timeline, host profile, and recommended remediation steps
6. Renders a self-contained HTML triage report with severity badges, IOC tables, and analyst notes

The result: a triage report that would take an analyst 30-45 minutes now takes under 60 seconds.

How we built it

• Splunk MCP integration: We use the mcp Python SDK (SSE client) to connect to the Splunk MCP server. Three core tools: splunk_run_query (SPL execution), splunk_get_metadata (index/field discovery), and saia_generate_spl (Foundation-sec SPL generation + threat classification).
• Agent loop: An async Claude tool-use loop drives the investigation. Claude decides which SPL queries to run, interprets results, and decides when it has enough context to write the report.
• Foundation-sec classification: The saia_generate_spl tool returns severity, attack category, confidence score, and summary. Claude uses this as a structured prior for its own reasoning.
• Report rendering: Jinja2 template generates a self-contained HTML report with inline CSS -- no external dependencies, sharable as a single file.
• Testing: 10 unit tests covering the MCP client, Foundation-sec integration, report renderer, and full agent loop (mocked).

Challenges we ran into

• The Splunk MCP SSE transport requires careful async handling -- we implemented 3-retry exponential backoff for connection resilience.
• Foundation-sec (saia_generate_spl) is a new tool with limited documentation. We built a graceful Claude fallback for any classification gaps.
• Structuring the agent loop so Claude knows WHEN to stop querying and start writing required careful system prompt design.

Accomplishments we're proud of

• Full end-to-end pipeline: raw alert in, HTML report out, no human in the loop
• Foundation-sec + Claude hybrid classification with confidence scoring
• Pre-rendered sample_report.html demonstrates the output without needing a live Splunk instance
• Architecture diagram auto-generated with the diagrams library

What we learned

Foundation-sec changes the security SOC game: having a model that speaks SPL natively means the agent can generate contextually appropriate queries without generic LLM hallucination. The MCP pattern (tool server + agent client) is the right abstraction for agentic security workflows.

What's next for SentinelAgent

• Webhook intake to connect directly to Splunk alerting actions
• Multi-alert correlation: detect attack chains across related alerts
• SOAR integration: auto-create tickets in ServiceNow / Jira from triage output
• Dashboard mode: rolling summary of all triaged alerts with trend analysis

Built With

• claude
• python