Inspiration
As a cybersecurity student gaining hands-on experience in SOC operations, I've seen how much time analysts spend manually investigating alerts before determining whether they're actual threats. A typical investigation often involves searching multiple log sources, correlating events, reviewing network activity, and documenting findings.
When I learned about the Splunk Agentic Ops Hackathon, I wanted to explore how AI agents could help automate this process. My goal was to build something that could act like a junior SOC analyst collecting evidence, analyzing activity, and generating structured incident reports to help analysts make faster decisions.
What it does
SOC Triage Agent connects to Splunk through the Splunk MCP Server and automatically investigates security alerts.
The agent gathers evidence from multiple security data sources, including AWS CloudTrail, Cisco ASA firewall logs, AWS VPC Flow Logs, and Bash history logs. It then uses Google Gemini to analyze events, correlate findings, identify suspicious activity, and generate structured incident reports with actionable recommendations.
The objective is to automate the first stages of incident investigation and reduce the amount of manual work required from SOC analysts.
How we built it
The project was built using Splunk Enterprise, the Splunk MCP Server, Google Gemini, and the BOTSv3 dataset.
First, I set up Splunk Enterprise and loaded the BOTSv3 dataset, which provides realistic attack scenarios and security telemetry. I then configured the Splunk MCP Server, including roles, permissions, and authentication tokens required for secure communication.
Once the MCP environment was operational, I integrated Google Gemini to analyze collected evidence and generate investigation reports.
The workflow is straightforward:
- Receive an alert or investigation request.
- Query relevant data from Splunk.
- Collect supporting evidence.
- Send findings to Gemini for analysis.
- Generate a structured incident report.
- Present recommendations for response.
Challenges we ran into
One of the biggest challenges was learning the Splunk MCP ecosystem. Understanding the architecture, permissions model, authentication process, and secure communication between the MCP Server and the agent required significant experimentation.
Another challenge was troubleshooting SSL certificate issues during local development. Since Splunk uses self-signed certificates by default, establishing reliable connectivity took time and testing.
Working with the BOTSv3 dataset was also challenging because of the large volume of available data. Choosing the most relevant sourcetypes while keeping the project focused required careful planning.
Finally, translating a human SOC investigation workflow into an AI-driven process required multiple iterations to ensure the agent gathered meaningful evidence and produced useful reports.
Accomplishments that we're proud of
- Successfully configured and integrated the Splunk MCP Server.
- Built an AI-powered investigation workflow using Google Gemini.
- Connected multiple security data sources into a single investigation process.
- Automated evidence gathering and incident report generation.
- Created a working proof of concept that demonstrates how agentic AI can support SOC operations.
- Completed an end-to-end security workflow from alert ingestion to report generation.
What we learned
This project provided hands-on experience with:
- Splunk Enterprise administration
- Splunk MCP Server integration
- Agentic AI workflows
- Security event correlation
- Incident response automation
- Cloud and network log analysis
- AI-assisted security operations
The biggest lesson was understanding how AI can augment security analysts rather than replace them. AI is most effective when it reduces repetitive tasks and allows analysts to focus on investigation, decision-making, and response.
What's next for SOC Triage Agent
Future improvements include:
- MITRE ATT&CK technique mapping
- Threat intelligence enrichment
- IOC extraction and validation
- Automated threat hunting workflows
- Real-time alert triage
- Multi-agent investigation capabilities
- Enhanced reporting and analyst feedback loops
The long-term vision is to evolve SOC Triage Agent into a more capable security operations assistant that can help organizations investigate incidents faster and more consistently.
Log in or sign up for Devpost to join the conversation.