# vrinda0211/agenticai-multiagent-soc architecture

> Architecture diagram of the GitHub repository vrinda0211/agenticai-multiagent-soc, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-09-27). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/vrinda0211/agenticai-multiagent-soc
- Repository: https://github.com/vrinda0211/agenticai-multiagent-soc

## Overview

This repository implements a SOC incident-analysis service: an event enters through the API, is triaged, investigated (with a retry to triage when confidence is low), given response recommendations, and persisted for analyst retrieval. Analysts can also query saved incidents through a copilot. Tool prompts and imports document the agent integrations; some tool implementations and frontend wiring were not sampled, so uncertain connections are omitted.

Main entry points: [`agents/triage_agent.py`](https://github.com/vrinda0211/agenticai-multiagent-soc/blob/main/agents/triage_agent.py) (Triage agent), [`agents/investigation_agent.py`](https://github.com/vrinda0211/agenticai-multiagent-soc/blob/main/agents/investigation_agent.py) (Investigation agent), [`graph.py`](https://github.com/vrinda0211/agenticai-multiagent-soc/blob/main/graph.py) (Workflow graph), [`agents/response_agent.py`](https://github.com/vrinda0211/agenticai-multiagent-soc/blob/main/agents/response_agent.py) (Response agent)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_entry["API and analyst access"]
  node_api["SOC API<br/>[api.py]"]
  node_web_ui["SOC web UI<br/>[index.html]"]
  node_chat_ui["Copilot chat UI<br/>[chat.html]"]
end

subgraph group_workflow["Incident workflow"]
  node_pipeline["Workflow graph<br/>[graph.py]"]
  node_state["Incident state<br/>[soc_state.py]"]
  node_triage["Triage agent<br/>[triage_agent.py]"]
  node_investigation["Investigation agent"]
  node_response_agent["Response agent<br/>[response_agent.py]"]
  node_retry["Rate-limit retry"]
end

subgraph group_intel["Investigation tools"]
  node_geoip["GeoIP lookup<br/>[geoip_tool.py]"]
  node_reputation["IP reputation"]
  node_history["Incident history"]
  node_patterns["Pattern detection"]
  node_mitre["MITRE lookup"]
  node_logs[("Cleaned event logs")]
end

subgraph group_response["Response tools"]
  node_escalation["Escalation decision<br/>[escalation_tool.py]"]
  node_remediation["Remediation guidance"]
  node_kb["Remediation knowledge"]
end

subgraph group_records["Incident records"]
  node_db[("Incident database<br/>[db_setup.py]")]
  node_copilot["SOC copilot<br/>[soc_copilot.py]"]
  node_dashboards["Grafana dashboards"]
end

node_analyst(("Security analyst"))
node_event_source(("Event source"))
node_groq["Groq language models"]

node_event_source -->|"submits event"| node_api
node_analyst -->|"uses"| node_web_ui
node_analyst -->|"asks questions"| node_chat_ui
node_web_ui -.->|"calls API"| node_api
node_chat_ui -.->|"calls API"| node_api
node_api -->|"invokes analysis"| node_pipeline
node_pipeline -->|"runs triage"| node_triage
node_pipeline -->|"runs investigation"| node_investigation
node_pipeline -->|"runs response"| node_response_agent
node_pipeline -->|"saves incident"| node_db
node_pipeline -->|"passes state"| node_state
node_triage -->|"updates state"| node_state
node_investigation -->|"updates state"| node_state
node_response_agent -->|"updates state"| node_state
node_triage -->|"looks up location"| node_geoip
node_triage -->|"checks reputation"| node_reputation
node_triage -->|"checks history"| node_history
node_investigation -->|"detects patterns"| node_patterns
node_investigation -->|"gathers evidence"| node_history
node_investigation -->|"maps techniques"| node_mitre
node_response_agent -->|"evaluates escalation"| node_escalation
node_response_agent -->|"gets actions"| node_remediation
node_history -->|"reads events"| node_logs
node_patterns -->|"reads events"| node_logs
node_remediation -->|"reads guidance"| node_kb
node_triage -->|"invokes model"| node_groq
node_investigation -->|"invokes model"| node_groq
node_response_agent -->|"invokes model"| node_groq
node_triage -->|"wraps model call"| node_retry
node_investigation -->|"wraps model call"| node_retry
node_response_agent -->|"wraps model call"| node_retry
node_api -->|"fetches incidents"| node_db
node_api -->|"forwards question"| node_copilot
node_copilot -->|"loads incident context"| node_db
node_copilot -->|"generates answer"| node_groq

click node_api "https://github.com/vrinda0211/agenticai-multiagent-soc/blob/main/api.py"
click node_web_ui "https://github.com/vrinda0211/agenticai-multiagent-soc/blob/main/index.html"
click node_chat_ui "https://github.com/vrinda0211/agenticai-multiagent-soc/blob/main/chat.html"
click node_pipeline "https://github.com/vrinda0211/agenticai-multiagent-soc/blob/main/graph.py"
click node_state "https://github.com/vrinda0211/agenticai-multiagent-soc/blob/main/agents/soc_state.py"
click node_triage "https://github.com/vrinda0211/agenticai-multiagent-soc/blob/main/agents/triage_agent.py"
click node_investigation "https://github.com/vrinda0211/agenticai-multiagent-soc/blob/main/agents/investigation_agent.py"
click node_response_agent "https://github.com/vrinda0211/agenticai-multiagent-soc/blob/main/agents/response_agent.py"
click node_retry "https://github.com/vrinda0211/agenticai-multiagent-soc/blob/main/utils/rate_limit_handler.py"
click node_geoip "https://github.com/vrinda0211/agenticai-multiagent-soc/blob/main/tools/geoip_tool.py"
click node_reputation "https://github.com/vrinda0211/agenticai-multiagent-soc/blob/main/tools/ip_reputation_tool.py"
click node_history "https://github.com/vrinda0211/agenticai-multiagent-soc/blob/main/tools/incident_history_tool.py"
click node_patterns "https://github.com/vrinda0211/agenticai-multiagent-soc/blob/main/tools/historical_pattern_tool.py"
click node_mitre "https://github.com/vrinda0211/agenticai-multiagent-soc/blob/main/tools/mitre_lookup_tool.py"
click node_escalation "https://github.com/vrinda0211/agenticai-multiagent-soc/blob/main/tools/escalation_tool.py"
click node_remediation "https://github.com/vrinda0211/agenticai-multiagent-soc/blob/main/tools/remediation_kb_tool.py"
click node_logs "https://github.com/vrinda0211/agenticai-multiagent-soc/tree/main/data/cleaned_logs"
click node_kb "https://github.com/vrinda0211/agenticai-multiagent-soc/blob/main/data/remediation_kb.json"
click node_db "https://github.com/vrinda0211/agenticai-multiagent-soc/blob/main/database/db_setup.py"
click node_copilot "https://github.com/vrinda0211/agenticai-multiagent-soc/blob/main/copilot/soc_copilot.py"
click node_dashboards "https://github.com/vrinda0211/agenticai-multiagent-soc/tree/main/grafana"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_api,node_web_ui,node_chat_ui toneBlue
class node_pipeline,node_state,node_triage,node_investigation,node_response_agent,node_retry toneAmber
class node_geoip,node_reputation,node_history,node_patterns,node_mitre,node_logs toneMint
class node_escalation,node_remediation,node_kb toneRose
class node_db,node_copilot,node_dashboards,node_analyst,node_event_source,node_groq toneIndigo
```

## Components

### API and analyst access

- [SOC API](https://github.com/vrinda0211/agenticai-multiagent-soc/blob/main/api.py): `api.py`
- [SOC web UI](https://github.com/vrinda0211/agenticai-multiagent-soc/blob/main/index.html): `index.html`
- [Copilot chat UI](https://github.com/vrinda0211/agenticai-multiagent-soc/blob/main/chat.html): `chat.html`

### Incident workflow

- [Workflow graph](https://github.com/vrinda0211/agenticai-multiagent-soc/blob/main/graph.py): `graph.py`
- [Incident state](https://github.com/vrinda0211/agenticai-multiagent-soc/blob/main/agents/soc_state.py): `agents/soc_state.py`
- [Triage agent](https://github.com/vrinda0211/agenticai-multiagent-soc/blob/main/agents/triage_agent.py): `agents/triage_agent.py`
- [Investigation agent](https://github.com/vrinda0211/agenticai-multiagent-soc/blob/main/agents/investigation_agent.py): `agents/investigation_agent.py`
- [Response agent](https://github.com/vrinda0211/agenticai-multiagent-soc/blob/main/agents/response_agent.py): `agents/response_agent.py`
- [Rate-limit retry](https://github.com/vrinda0211/agenticai-multiagent-soc/blob/main/utils/rate_limit_handler.py): `utils/rate_limit_handler.py`

### Investigation tools

- [GeoIP lookup](https://github.com/vrinda0211/agenticai-multiagent-soc/blob/main/tools/geoip_tool.py): `tools/geoip_tool.py`
- [IP reputation](https://github.com/vrinda0211/agenticai-multiagent-soc/blob/main/tools/ip_reputation_tool.py): `tools/ip_reputation_tool.py`
- [Incident history](https://github.com/vrinda0211/agenticai-multiagent-soc/blob/main/tools/incident_history_tool.py): `tools/incident_history_tool.py`
- [Pattern detection](https://github.com/vrinda0211/agenticai-multiagent-soc/blob/main/tools/historical_pattern_tool.py): `tools/historical_pattern_tool.py`
- [MITRE lookup](https://github.com/vrinda0211/agenticai-multiagent-soc/blob/main/tools/mitre_lookup_tool.py): `tools/mitre_lookup_tool.py`
- [Cleaned event logs](https://github.com/vrinda0211/agenticai-multiagent-soc/tree/main/data/cleaned_logs): `data/cleaned_logs`

### Response tools

- [Escalation decision](https://github.com/vrinda0211/agenticai-multiagent-soc/blob/main/tools/escalation_tool.py): `tools/escalation_tool.py`
- [Remediation guidance](https://github.com/vrinda0211/agenticai-multiagent-soc/blob/main/tools/remediation_kb_tool.py): `tools/remediation_kb_tool.py`
- [Remediation knowledge](https://github.com/vrinda0211/agenticai-multiagent-soc/blob/main/data/remediation_kb.json): `data/remediation_kb.json`

### Incident records

- [Incident database](https://github.com/vrinda0211/agenticai-multiagent-soc/blob/main/database/db_setup.py): `database/db_setup.py`
- [SOC copilot](https://github.com/vrinda0211/agenticai-multiagent-soc/blob/main/copilot/soc_copilot.py): `copilot/soc_copilot.py`
- [Grafana dashboards](https://github.com/vrinda0211/agenticai-multiagent-soc/tree/main/grafana): `grafana`

### Other components

- **Security analyst**
- **Event source**
- **Groq language models**

## Connections

- Event source → SOC API: submits event
- Security analyst → SOC web UI: uses
- Security analyst → Copilot chat UI: asks questions
- SOC web UI → SOC API: calls API
- Copilot chat UI → SOC API: calls API
- SOC API → Workflow graph: invokes analysis
- Workflow graph → Triage agent: runs triage
- Workflow graph → Investigation agent: runs investigation
- Workflow graph → Response agent: runs response
- Workflow graph → Incident database: saves incident
- Workflow graph → Incident state: passes state
- Triage agent → Incident state: updates state
- Investigation agent → Incident state: updates state
- Response agent → Incident state: updates state
- Triage agent → GeoIP lookup: looks up location
- Triage agent → IP reputation: checks reputation
- Triage agent → Incident history: checks history
- Investigation agent → Pattern detection: detects patterns
- Investigation agent → Incident history: gathers evidence
- Investigation agent → MITRE lookup: maps techniques
- Response agent → Escalation decision: evaluates escalation
- Response agent → Remediation guidance: gets actions
- Incident history → Cleaned event logs: reads events
- Pattern detection → Cleaned event logs: reads events
- Remediation guidance → Remediation knowledge: reads guidance
- Triage agent → Groq language models: invokes model
- Investigation agent → Groq language models: invokes model
- Response agent → Groq language models: invokes model
- Triage agent → Rate-limit retry: wraps model call
- Investigation agent → Rate-limit retry: wraps model call
- Response agent → Rate-limit retry: wraps model call
- SOC API → Incident database: fetches incidents
- SOC API → SOC copilot: forwards question
- SOC copilot → Incident database: loads incident context
- SOC copilot → Groq language models: generates answer