alert-triage

Open-source AI Security Operations Center: alert fusion, LLM-agent triage, MITRE ATT&CK investigation, and a replayable decision ledger for every agent step. Self-hostable, runs with no API keys, MIT licensed. Ships an MCP server for Claude, Cursor and Continue.

Local-LLM alert triage for self-hosted SOCs.

EFF-Assistant是一款面向安全运营场景的浏览器插件，让现有 WAF、NDR、SOC 等安全设备快速具备告警解析、AI 研判、资产关联与工单联动能力。

n8n workflow that pipes Wazuh SIEM alerts through Claude Haiku for AI triage. ~$0.001 per alert. Slack output with risk assessment + investigation commands.

Enterprise-focused cybersecurity portfolio demonstrating hands-on expertise in SOC operations, SIEM threat detection, incident response, GRC, risk management, and security automation. Features Splunk log analysis, threat investigations, detection engineering, risk assessments, incident response playbooks, automated security workflows, and an end-to

SOC子引擎，基于agent-skills技术通过AI赋能SOC平台，对SOC告警进行研判、调查、响应。

SentinelForge: Autonomous SOC analyst platform with AI agents for alert triage, log correlation, threat hunting, and incident response.

ML-based SOC alert triage system using Random Forest to auto-classify alerts as True/False Positive — reducing analyst workload with real-time confidence scoring and live dashboard.

Real-data SOC alert triage engine & training package. Multi-format log parser, attack-chain correlation, FP heuristics & MITRE mapping — pure Python stdlib, zero dependencies.

AI-powered Security Operations (SOC) system that automates L1 alert triage, threat enrichment, and incident response.

Command-line tool that turns one day of Wazuh alerts into a short review queue for the next morning.

One AI Security Platform: Protect, Operate, Respond

Agentic L1 SOC analyst that triages SIEM alerts (Splunk, QRadar, Elastic, Sentinel, Wazuh), enriches with CrowdStrike, cites its reasoning, and learns from analyst corrections — self-hosted.

LLM-powered, ATT&CK-grounded security log triage with RAG — turn an alert flood into a short list of explained, prioritized incidents.

CoAnalyst: a LangGraph research analyst for OT/IT alert triage with human review.

Local-first AI triage for security alerts: signed webhook → RabbitMQ → threat-intel enrichment → MITRE ATT&CK retrieval (pgvector) → local LLM (Ollama / llama.cpp) with constrained JSON → safety gate → human approval behind Keycloak. Includes an evaluation of accuracy, calibration and prompt injection.

AI-powered SIEM alert triage assistant for SOC analysts: classifies, prioritizes, and recommends response actions.

30+ projects AWS SOC/SOAR Ecosystem portfolio with Wazuh, TheHive, Cortex, MISP, n8n, network security monitoring, Threat Detection & Hunting, Alert triage, Log Analysis, Detection engineering, Incident Response, dashboards, and AI security automation.

AML triage prototype - This is a small Python prototype demonstrating how transaction monitoring alerts can be risk-scored and summarised for investigator review.

A local-LLM SOC analyst: an L1 agent (Gemma via Ollama) triages overnight SIEM alerts, learns benign patterns, and escalates only what it cannot resolve to an L2 (Claude) review. Runs on-box, free.