{"id":"7cd5aa15-0635-4900-aca6-27254891d948","slug":"secops-agent-triage","kind":"mcp","name":"secops-agent-triage","summary":"Tool-calling SOC triage agent with multi-format alert ingestion, threat-intelligence enrichment, and structured NIST/MITRE assessments.","owner":"drummer475-94","repoUrl":"https://github.com/drummer475-94/secops-agent-triage","license":"MIT","licenseTier":"permissive","trust":"community","stars":0,"match":null,"fewStars":true,"format":"mcp","createdAt":"2026-08-13T21:19:10.000Z","addedAt":"2026-10-21T06:34:05.777Z","logoUrl":"https://avatars.githubusercontent.com/u/225997213?v=4","linkOnly":false,"collection":null,"skillPath":null,"categories":["memory-knowledge"],"tags":["cybersecurity","incident-response","mitre-attack","python","soc-automation","threat-intelligence","ai-agents","threat-intel"],"runtime":"python","local":true,"cloudCapable":false,"cloudCapability":"unknown","cloudReadyOnPlatform":false,"needsApiKey":false,"reviewed":false,"syncedAt":"2026-10-23T03:59:13.104Z","sample":false,"url":"https://conduits.dev/tools/secops-agent-triage","language":"Python","transports":["stdio"],"install":{"pypi":"secops-agent-triage"},"requirements":{"env":[],"upstreamMayCharge":false},"tools":null,"readme":"# secops-agent-triage: AI Agentic Security Triage & MCP Workflow\n\n[![Python Version](https://img.shields.io/badge/python-3.11%2B-blue.svg)](https://www.python.org/)\n[![MCP Ready](https://img.shields.io/badge/MCP-tool--calling%20ready-purple.svg)](https://modelcontextprotocol.io/)\n[![Coverage](https://img.shields.io/badge/coverage-%3E90%25-brightgreen.svg)](pyproject.toml)\n[![License](https://img.shields.io/badge/license-MIT-green.svg)](LICENSE)\n\n`secops-agent-triage` is a portfolio Model Context Protocol (MCP) and CLI security-triage implementation for repeatable Tier 1 SOC alert analysis. It ingests raw security logs (Windows Event Logs, AWS CloudTrail, Syslog), extracts IOC entities, orchestrates configurable threat-intelligence adapters (VirusTotal, AbuseIPDB, AlienVault OTX), constructs inspectable decision traces, and outputs structured JSON assessments with legacy **NIST SP 800-61 Rev. 2-style** phases and **MITRE ATT&CK** technique mappings. NIST SP 800-61 Rev. 3 is the current guidance; deterministic mock mode is provided for offline verification.\n\n---\n\n## ⚡ 60-Second Quick Review Guide\n\n| Key Feature | Implementation Highlights |\n|-------------|---------------------------|\n| **Multi-Format Ingestion Engine** | Unified facade parsing Windows Event Logs (EVTX EventID 4688, 4624, 4625, 7045), AWS CloudTrail JSON, and Syslog (RFC 5424 / 3164) with Base64 PowerShell payload decoding. |\n| **Async Threat Intel Tools** | Parallel async API tools for VirusTotal, AbuseIPDB, and AlienVault OTX with deterministic mock fallback when API keys are omitted. |\n| **Verifiable Reasoning Engine** | Emits multi-step `ReasoningStep` traces detailing exact actions taken, observations, logical deductions, and confidence scores for auditability. |\n| **Industry Framework Mapping** | Mapping to MITRE ATT&CK technique IDs (e.g. `T1059.001`, `T1110.001`, `T1098`) and legacy NIST SP 800-61 Rev. 2 incident categories (`CAT 1`, `CAT 2`, `CAT 3`). |\n| **Dual Interface Architecture** | Standalone CLI (`secops-triage`) and Model Context Protocol (MCP) server supporting stdio transport. |\n| **Test Suite & Coverage** | Comprehensive 60-test pytest suite with **93.81% total coverage** testing parsers, tools, engine, CLI, MCP endpoints, and malformed-input resilience. |\n\n---\n\n## 🏗️ Architecture & Data Flow\n\n```mermaid\ngraph TD\n    Alert[Raw Security Alert: EVTX / CloudTrail / Syslog] --> Ingest[Ingestion Facade & Parser]\n    Ingest --> Extract[Entity Extraction: IPs, Hashes, Domains, Accounts]\n    \n    subgraph Threat_Intel_Orchestration [Async Threat Intel Tools]\n        VT[VirusTotal Tool]\n        Abuse[AbuseIPDB Tool]\n        OTX[AlienVault OTX Tool]\n    end\n\n    Extract --> VT\n    Extract --> Abuse\n    Extract --> OTX\n    \n    VT --> Engine[Verifiable Reasoning Engine]\n    Abuse --> Engine\n    OTX --> Engine\n    \n    Engine --> Trace[Step-by-Step Reasoning Trace Construction]\n    Trace --> Mapper[NIST SP 800-61 & MITRE ATT&CK Mapper]\n    Mapper --> Output[Structured TriageAssessment JSON]\n    \n    Output --> CLI[CLI Interface: secops-triage]\n    Output --> MCP[MCP Server: stdio transport]\n```\n\n---\n\n## 🚀 Installation & Setup\n\n```bash\n# Clone repository and navigate to folder\ncd secops-agent-triage\n\n# Install package in editable mode with test dependencies\npip install -e \".[test]\"\n```\n\n---\n\n## 💻 CLI Usage\n\nThe CLI (`secops-triage` or `python -m secops_agent_triage.cli`) accepts raw logs via string or file, auto-detects formats, and outputs structured `TriageAssessment` JSON.\n\n### 1. Default Sample Run (Windows EventID 4688 Execution)\n```bash\nsecops-triage --mock\n```\n\n### 2. File Ingestion\n```bash\nsecops-triage --file sample_cloudtrail.json --format cloudtrail --mock --output-json assessment.json\n```\n\n### 3. Inline Raw Alert\n```bash\nsecops-triage --raw \"<165>1 2026-08-13T11:00:00Z edge-fw sshd 1234 - - Failed password for root from 192.0.2.1 port 22\" --format syslog --mock\n```\n\n---\n\n## 🤖 Model Context Protocol (MCP) Server Setup\n\n`secops-agent-triage` exposes MCP tools for integration into AI agent workbenches (e.g. Claude Desktop, VS Code Antigravity IDE):\n\n### MCP Tools Provided:\n- `triage_security_alert`: Complete alert ingestion, threat intel lookup, reasoning trace, and NIST/MITRE assessment.\n- `lookup_ip_reputation`: Queries VirusTotal, AbuseIPDB, and AlienVault OTX for IP reputation.\n- `lookup_hash_reputation`: Queries VirusTotal and AlienVault OTX for file hash reputation.\n- `lookup_domain_reputation`: Queries VirusTotal and AlienVault OTX for domain reputation.\n\n### MCP Configuration (`claude_desktop_config.json` or `mcp_settings.json`):\n```json\n{\n  \"mcpServers\": {\n    \"secops-agent-triage\": {\n      \"command\": \"python\",\n      \"args\": [\"-m\", \"secops_agent_triage.mcp_server\"],\n      \"env\": {}\n    }\n  }\n}\n```\n\nMock mode is the safe default and needs no credentials. For live lookups, set `VT_API_KEY`, `ABUSEIPDB_API_KEY`, and/or `OTX_API_KEY` in the MCP client environment; never commit API keys to the configuration file.\n\n---\n\n## 🧪 Testing & Coverage\n\nRun the unit and integration test suite:\n\n```bash\npytest --cov=secops_agent_triage --cov-report=term-missing --cov-fail-under=90\n```\n\n### Test Coverage Results:\n```\nTOTAL: 773 statements, 93.81% coverage\nAll 60 test cases PASSED.\n```\n"}