How vrinda0211/agenticai-multiagent-soc works
This repository implements a SOC incident-analysis service: an event enters through the API, is triaged, investigated (with a retry to triage when confidence is low), given response recommendations, and persisted for analyst retrieval. Analysts can also query saved incidents through a copilot. Tool prompts and imports document the agent integrations; some tool implementations and frontend wiring were not sampled, so uncertain connections are omitted.
Main entry points: triage_agent.py Triage agent · investigation_agent.py Investigation agent · graph.py Workflow graph · response_agent.py Response agent
Components 24
API and analyst access
- SOC API
api.py - SOC web UI
index.html - Copilot chat UI
chat.html
Incident workflow
- Workflow graph
graph.py - Incident state
agents/soc_state.py - Triage agent
agents/triage_agent.py - Investigation agent
agents/investigation_agent.py - Response agent
agents/response_agent.py - Rate-limit retry
utils/rate_limit_handler.py
Investigation tools
- GeoIP lookup
tools/geoip_tool.py - IP reputation
tools/ip_reputation_tool.py - Incident history
tools/incident_history_tool.py - Pattern detection
tools/historical_pattern_tool.py - MITRE lookup
tools/mitre_lookup_tool.py - Cleaned event logs
data/cleaned_logs
Response tools
- Escalation decision
tools/escalation_tool.py - Remediation guidance
tools/remediation_kb_tool.py - Remediation knowledge
data/remediation_kb.json
Incident records
- Incident database
database/db_setup.py - SOC copilot
copilot/soc_copilot.py - Grafana dashboards
grafana
Other components
- Security analyst
- Event source
- Groq language models
Connections 35
- Event source → SOC API: submits event
- Security analyst → SOC web UI: uses
- Security analyst → Copilot chat UI: asks questions
- SOC web UI → SOC API: calls API
- Copilot chat UI → SOC API: calls API
- SOC API → Workflow graph: invokes analysis
- Workflow graph → Triage agent: runs triage
- Workflow graph → Investigation agent: runs investigation
- Workflow graph → Response agent: runs response
- Workflow graph → Incident database: saves incident
- Workflow graph → Incident state: passes state
- Triage agent → Incident state: updates state
- Investigation agent → Incident state: updates state
- Response agent → Incident state: updates state
- Triage agent → GeoIP lookup: looks up location
- Triage agent → IP reputation: checks reputation
- Triage agent → Incident history: checks history
- Investigation agent → Pattern detection: detects patterns
- Investigation agent → Incident history: gathers evidence
- Investigation agent → MITRE lookup: maps techniques
- Response agent → Escalation decision: evaluates escalation
- Response agent → Remediation guidance: gets actions
- Incident history → Cleaned event logs: reads events
- Pattern detection → Cleaned event logs: reads events
- Remediation guidance → Remediation knowledge: reads guidance
- Triage agent → Groq language models: invokes model
- Investigation agent → Groq language models: invokes model
- Response agent → Groq language models: invokes model
- Triage agent → Rate-limit retry: wraps model call
- Investigation agent → Rate-limit retry: wraps model call
- Response agent → Rate-limit retry: wraps model call
- SOC API → Incident database: fetches incidents
- SOC API → SOC copilot: forwards question
- SOC copilot → Incident database: loads incident context
- SOC copilot → Groq language models: generates answer