Splunk Agentic Ops — Incident Copilot

▶ Demo video: https://youtu.be/g58XDpdq6wc · ▶ Repo: https://github.com/cjw0076/splunk-agentic-ops-copilot

An agentic incident-investigation copilot that, on an anomaly trigger, drives a real investigation loop over Splunk data: anomaly → hypothesis → run SPL to confirm or refute → follow contradictions → evidence-justified verdict. Built for the Splunk Agentic Ops Hackathon.

What makes it prize-caliber

• A real SPL engine, not string matching. A ~1,000-line SPL interpreter executes search / stats / where / eval / rex / sort / table / transaction over event data, so the agent's queries actually run and return tables — the same SPL an analyst would type.
• Self-correcting investigation loop. The agent forms a hypothesis, runs SPL to test it, and revises course when results contradict it — instead of narrating a fixed script. Every confirmed step is pinned to the SPL that proved it, in an append-only evidence ledger.
• 5 end-to-end incident scenarios. external credential-stuffing breach · ransomware (shadow-copy deletion → mass encryption → C2) · insider auto-PRR · cloud account takeover · supply-chain compromise — each a multi-stage attack the copilot has to reason through.
• Live copilot dashboard. Pick a scenario and watch SPL searches stream, result tables fill, and the verdict assemble in real time (shown in the video).
• Pluggable Splunk REST backend. A SplunkRestBackend lets the identical agent run against a real Splunk instance, not only the bundled engine.
• 41 passing tests plus an eval harness that scores investigation outcomes.

How it runs

anomaly trigger
  → hypothesis
  → run SPL searches against event data (real interpreter)
  → confirm / refute / follow new leads
  → append each proven step + its SPL to the evidence ledger
  → evidence-justified incident verdict + recommended response

MIT-licensed, runs fully offline, and drops into a live Splunk via REST.

Built With

• agents
• mitre-attack
• python
• security
• spl
• splunk