MirrorLens for Splunk

• 

  Connect to Splunk MCP Server

• 

  Autonomous investigation in progress

• 

  Analysis and detection rule generation

• 

  Detection rule fired with validated alerts

Inspiration

Security teams already have deep telemetry in Splunk, but turning that data into a complete investigation is still too manual. Analysts have to search, pivot across indexes, correlate events, understand detection coverage, and decide what to do next under time pressure. MirrorLens for Splunk explores what happens when an AI agent can perform that workflow directly through Splunk MCP Server, while keeping every step tied back to real evidence.

What It Does

MirrorLens for Splunk is an autonomous AI security investigator for Splunk. It connects through Splunk MCP Server, discovers available indexes, hosts, sourcetypes, saved searches, and relevant fields, then runs targeted SPL queries through a ReAct loop: reason, act, observe.

The agent summarizes MITRE ATT&CK-mapped findings, identifies detection gaps, generates SPL detection rules, validates those rules against Splunk data, and reports match counts. When a validated rule actually fires, the dashboard raises a full-screen alert with the rule, SPL, and sample matches. The investigation closes with a response playbook and then enters watch mode, polling for new data sources that may require another investigation.

How We Built It

We built MirrorLens around Splunk Enterprise, the official Splunk MCP Server, Claude tool use, and a real-time web dashboard. The backend runs a bounded ReAct investigation loop with tools for Splunk discovery, field exploration, SPL execution, evidence analysis, detection rule validation, and final findings submission.

The dashboard uses FastAPI, WebSockets, React, TypeScript, and a result-first security UI. It streams investigation progress live, keeps MCP calls and reasoning available in an agent trace, and presents the key outputs analysts care about: attack findings, validated detection rules, visibility gaps, alerts, and response actions. The public repository includes setup instructions, sample investigation data, example configuration, and an architecture diagram.

Challenges We Ran Into

The hardest part was making the demo both autonomous and grounded. We wanted the AI to adapt its SPL queries based on what Splunk returned, but not drift into unsupported conclusions. We solved that by forcing the investigation loop to collect evidence through MCP, preserve the tool trace, and validate generated detections against Splunk data before presenting them as useful coverage.

Another challenge was keeping the submission safe and reproducible. The video and sample flow use sanitized data, avoid private tokens, and keep the project open-source friendly while still showing a realistic SOC workflow.

Accomplishments That We're Proud Of

We are proud that MirrorLens demonstrates more than a chatbot over logs. It performs autonomous discovery, adaptive SPL investigation, evidence-backed MITRE ATT&CK analysis, validated detection rule generation, live rule-match proof, and response planning through Splunk MCP Server.

The strongest part is validation: MirrorLens does not just suggest a detection rule; it tests whether the rule would actually match Splunk events and surfaces the result to the analyst.

What We Learned

We learned that agentic security workflows are strongest when the AI is constrained by evidence and tool results. Splunk MCP Server gives the agent a clean, standardized way to inspect data, run SPL, and validate hypotheses without building brittle one-off REST integrations.

We also learned that the UI matters: analysts need a result-first dashboard, but they also need access to the reasoning and MCP proof when they want to audit how the agent reached a conclusion.

What's Next for MirrorLens for Splunk

Next, we want to expand MirrorLens into a reusable agentic investigation layer for Splunk-driven security operations. That includes richer playbooks, multi-tenant Splunk support, broader anomaly triage, optional human-approved response actions, and integrations with SOAR or case-management systems for closed-loop detection, investigation, and response.

Built With

• anthropic
• claude
• docker
• fastapi
• javascript
• mcp
• postgresql
• python
• react
• security
• siem
• splunk
• typescript
• websockets