utpaat0xsabir/ai-soc-agent

How utpaat0xsabir/ai-soc-agent works

This repository implements a Wazuh-focused SOC investigation toolkit. Analysts retrieve alerts, correlate them into incidents and service campaigns, investigate evidence (including host-service outcomes and ATT&CK mappings), and generate reports; a separate tool provides single-alert AI analysis. The graph preserves the documented remote SSH evidence path. The README is empty, and sampled excerpts do not expose every orchestration call, so some subsystem links are omitted rather than inferred.

Main entry points: incident_investigator.py Incident Investigation · wazuh_client.py Alert Retrieval · remote_evidence_collector.py Remote Evidence Collection · correlation_engine.py Incident Correlation

Components 14

Alert Collection

Alert Retrieval wazuh_client.py

Correlation and Investigation

Incident Correlation correlation_engine.py
Incident Investigation incident_investigator.py
Outcome Verification incident_investigator.py
ATT&CK Mapping incident_investigator.py

Host Evidence

Local Host Evidence incident_investigator.py
Remote Evidence Collection remote_evidence_collector.py

AI and Reporting

Single-Alert AI Analysis wazuh_ai.py
Investigation AI Interpretation incident_investigator.py
Report Generation report_generator.py

Other components

SOC Analyst
Wazuh Indexer
Monitored Host
Ollama

Connections 14

SOC Analyst → Incident Investigation: initiates investigation incident_investigator.py
SOC Analyst → Single-Alert AI Analysis: requests alert analysis wazuh_ai.py
Wazuh Indexer → Alert Retrieval: returns alerts wazuh_client.py
Incident Investigation → Alert Retrieval: retrieves alerts incident_investigator.py
Incident Investigation → Incident Correlation: correlates alerts incident_investigator.py
Incident Correlation → Alert Retrieval: uses client correlation_engine.py
Incident Investigation → Local Host Evidence: collects host evidence incident_investigator.py
Incident Investigation → Outcome Verification: verifies outcomes incident_investigator.py
Incident Investigation → ATT&CK Mapping: maps techniques incident_investigator.py
Remote Evidence Collection → Monitored Host: collects over SSH remote_evidence_collector.py
Remote Evidence Collection → Incident Investigation: supplies evidence remote_evidence_collector.py
Single-Alert AI Analysis → Ollama: requests inference wazuh_ai.py
Investigation AI Interpretation → Ollama: requests inference
Incident Investigation → Report Generation: generates report incident_investigator.py

Drawn by GitDiagram on November 14, 2026 from the repository's file tree, README and source files. Read as Markdown ·