SOC Triage Agent

Stop drowning in alerts. Let AI triage, enrich, and escalate — while your analysts hunt real threats.

Comment

Inspiration

Security Operations Center analysts are overwhelmed. A typical SOC team receives hundreds of alerts daily — yet studies show over 80% are false positives. Every alert still demands investigation, creating massive alert fatigue, slower response times, and burned-out analysts. Tier-1 triage — pulling alert details, checking IP reputation, correlating events, writing incident reports — is repetitive, time-consuming work that a well-designed AI agent can handle autonomously.

What it does

SOC Triage Agent is an autonomous Tier-1 SOC analyst powered by Gemini and Elasticsearch. Given a queue of security alerts, it:

  1. Ingests open Critical and High severity alerts from Elasticsearch SIEM
  2. Enriches each source IP against AbuseIPDB threat intelligence
  3. Correlates related events by IP address, hostname, and MITRE tactic
  4. Classifies each alert — Escalate to Tier-2, Monitor & Investigate, or Log & Close
  5. Generates a structured incident report with MITRE ATT&CK mapping and recommended remediation steps
  6. Updates alert status in Elasticsearch automatically

Analysts get a real-time dashboard showing the full alert queue, IP reputation results, and generated incident reports — ready to act on immediately.

How we built it

Architecture:

  • Gemini 3.5 Flash (via Google ADK + AI Studio API) — agent brain and orchestration
  • Google ADK (Agent Development Kit) — multi-step agent framework connecting Gemini to MCP tools
  • Custom MCP Server — 9 tools built with FastMCP, deployed on Google Cloud Run
  • Elasticsearch (Elastic Cloud Serverless) — SIEM data store and alert index
  • AbuseIPDB API — real-time IP reputation and threat intelligence
  • Cloud Run — serverless deployment of the MCP server backend
  • HTML/CSS/JS — analyst-facing dashboard frontend

The ADK agent successfully connects to the live MCP server on Cloud Run, calls tools like get_alert_summary, get_open_alerts, and check_ip_reputation in real time, and returns structured triage results — demonstrating full end-to-end Gemini → ADK → MCP → Elasticsearch pipeline.

Challenges we ran into

  • MCP authentication in Agent Builder UI is marked "Coming Soon" — we worked around this by deploying our own MCP server on Cloud Run with full control over the toolset
  • Vertex AI model access required careful project configuration to use the correct Gemini model strings
  • Alert correlation across multiple indices required careful Elasticsearch query design to avoid false correlations

Connecting Google ADK to a remotely hosted MCP server required disabling FastMCP's DNS rebinding protection (introduced in MCP SDK v1.24+), which by default only allows localhost connections. Setting host="0.0.0.0" at FastMCP initialization resolves this for Cloud Run deployments.

Accomplishments that we're proud of

  • Built a fully functional end-to-end triage pipeline from alert ingestion to incident report in under a week
  • Custom MCP server with 9 tools live on Cloud Run — callable by any MCP-compatible agent
  • Real threat intelligence integration catching confirmed malicious IPs (TOR exit nodes, known C2 infrastructure)
  • Incident reports that match real SOC documentation standards including MITRE ATT&CK mapping

What we learned

  • How to design and deploy a custom MCP server that bridges an AI agent to external APIs
  • The practical challenges of integrating AI agents into security workflows — false positive rates, enrichment reliability, escalation thresholds
  • Google ADK's agent orchestration model and how sub-agents can specialize in specific tasks

What's next for SOC Triage Agent

  • SOAR integration — auto-create tickets in Jira/ServiceNow on escalation
  • Multi-source ingestion — pull alerts from multiple SIEM platforms beyond Elasticsearch
  • Analyst feedback loop — let analysts rate triage decisions to improve classification over time
  • Threat hunting mode — proactively search for IOCs across historical log data
  • Slack/Teams notifications — push escalations directly to analyst channels

Built With

Share this project:

Updates

Submission history