soc-automation

A modular, skill-based autonomous Security Operations Center (SOC) agent that monitors OpenSearch/Elasticsearch data, builds RAG-based behavioral memory, and validates real-time anomalies using LLMs.

CABTA (Blue Team Assistant) - AI-Powered SOC Platform for Threat Analysis, IOC Investigation & Email Forensics

Find relevant incidents, logs, events, and alerts to all of your incidents. [Attack Flows, Attack Chains, & Root Cause Discovery - NO LLMs, NO Queries, Just Explainable Machine Learning] >> Use it for free here: https://app.cypienta.io

SOC Automation Security Suite Installer and Update Hub 2026

Agentic memory for CTI in Python — STIX knowledge graphs, threat-actor alias resolution, offline-first RAG, MCP server for Claude Code and LangChain agents

Blackhat 2025 presentation and codebase: AI SOC agent & MCP server for automated security investigation, alert triage, and incident response. Integrates with ELK, IRIS, and other platforms.

An extensible, deterministic static‑analysis engine that extracts high‑signal IOCs from PE binaries and text, built for SOC automation and modern threat‑analysis pipelines.

Autonomous security operations — fifteen agents in continuous operation, and the audit trail that lets someone else check them.

ICS Incident Response Automation Framework Python framework for executing automated incident response playbooks in ICS/SCADA environments. Supports network isolation, forensic preservation, logic restoration, and safety system interventions. Designed for defenders, researchers, and red team simulations in operational technology networks.

Autonomous agentic threat hunting playbook executor for SOC/DFIR pros. Runs YAML playbooks against forensic logs with local LLMs (Ollama) for intelligent correlation, triage, ATT&CK mapping, and automated reporting. Offline-first, DuckDB-powered.

The detection engine: correlation rules on the event stream you already forward, outside the SIEM. Sequences across hosts in log time, state that survives a crash. Rust, no JVM, embeddable.

Building one Solution for Threat management and detection for you network with Open source SOC solution.

Open-source AI cybersecurity agent skills for SOC, incident response, threat hunting, red team, blue team, and DevSecOps. 79 skills + 12 cs-* orchestrator agents across 12 security domains. Mapped to MITRE ATT&CK and NIST CSF 2.0. Runs in Claude, ChatGPT, Gemini, Ollama, and AnythingLLM with no SaaS lock-in.

Master n8n workflow automation from beginner to expert level. 90-day structured learning path with real security use cases, sample workflows, and hands-on projects for Network Security Engineers and SOC teams. Build SOAR-like systems using n8n.

AI-powered Security Operations (SOC) system that automates L1 alert triage, threat enrichment, and incident response.

🤖 AI-powered SOC lab — Wazuh SIEM + TheHive + Shuffle + MISP + Ollama LLaMA3 for LLM-powered alert triage, AI threat analysis, and automated incident response. Free & open-source.

🛡️ CyberSentinel – Threat Intel + Log Correlation Dashboard. An analyst-grade security tool that ingests threat intelligence, parses SSH/Apache logs, correlates IOCs, and generates real-time alerts.

End-to-end SOC automation lab: Sysmon → Wazuh → Shuffle → TheHive. Detects and triages Credential Dumping (MITRE T1003) in real time, cutting MTTR to seconds.

Open-source SOC system that monitors your Linux server in real-time, automatically detects and blocks threats using Groq AI and Telegram Bot integration.

Enterprise-style SOC Detection & Response lab built using Wazuh SIEM, featuring MITRE ATT&CK aligned detections, alert triage, and evidence-based investigations across Windows and Linux endpoints.