agentic-soc-platform
Automates security incident triage, log investigation, and threat intelligence enrichment using AI agents.
Correlate alerts, automate investigations with LLMs, and enrich security context from multiple SIEM sources.
Agentic SOC Platform is an open-source security operations framework that uses AI agents to automate log analysis, incident enrichment, and triage. You can deploy it locally to convert raw SIEM alerts into correlated cases without sending security data to third-party SaaS vendors.
What it is
The platform streams SIEM or Webhook alerts to group raw IOCs into structured cases. It orchestrates LLMs and traditional SOAR playbooks to automatically run threat intelligence lookups, generate investigation reports, and retain knowledge from past incidents.
Who it's for
It suits security engineering and SOC teams who manage SIEM setups like Splunk or Elastic and want to automate alert analysis. It is not suitable for small teams without an established SIEM or those lacking Python development skills to build custom modules.
Key features
Automated Case Correlation
Streams SIEM and Webhook alerts, extracts IOCs, and groups related security signals into actionable cases.
Harness Agent Integration
Connects directly to CLI agents like Claude Code, Codex, or OpenCode to query logs and run playbooks.
Multi-SIEM Ingestion
Integrates log search and alert context across Splunk, Elastic, and custom webhooks in one interface.
Threat Intelligence Enrichment
Automatically appends reputation scores, asset records, and historical context to suspicious artifacts.
Knowledge Accumulation
Extracts reusable incident insights from closed cases to improve future automated investigations.
Up and running in 3 steps
Our honest verdict
What's great
- Integrates directly with external harness agents like Claude Code and OpenCode via CLI and plugins.
- Supports Python modules for custom SIEM rule adaptation and alert parsing.
- Combines traditional SOAR playbook automation with LLM-driven investigation logic.
- Extracts historical investigation lessons into a reusable knowledge store.
Where it falls short
- Requires self-hosting infrastructure and ongoing upkeep for Python and TypeScript environments.
- Incurs API token costs when querying commercial LLM providers for automated triage.
- Demands technical effort to build custom Python modules for non-standard alert sources.
Pricing & license
Agentic SOC Platform is free to use under the MIT license. Your primary expenses will stem from self-hosting server infrastructure and external LLM API usage fees.
Open remote AI-training roles
880 open remote AI-training roles, updated November 15, 2026; most pay $20–$175 an hour. Zekai lists them free; the application goes to the employer’s platform.
Alternatives
These reviewed AI tools do the same job instantly — from our scored directory.
Use it, or have us set it up
FAQ
Does Agentic SOC Platform replace existing SIEM tools?
No, it sits on top of Splunk, Elastic, or Webhooks to correlate alerts and run AI-assisted investigations.
Can you run this entirely on-premise?
Yes, the platform supports private local deployment so your security logs stay within your network.
