MCP 服务器

AI SOC Agent MCP Server

Enables SOC analysts to analyze security incidents, map to MITRE ATT&CK, calculate severity, and recommend remediation actions.

README

Agentic AI Security Operations Platform

An Agentic AI-powered Security Operations Platform that automates security investigations through a coordinated multi-agent workflow. The platform combines threat detection, threat intelligence enrichment, MITRE ATT&CK mapping, case management, FastAPI services, and a React dashboard to help analysts investigate and prioritize security incidents.

The project demonstrates practical implementation of Agentic AI architectures, Model Context Protocol (MCP), Pydantic AI, multi-agent systems, and security automation within a modern Security Operations Center (SOC) environment.

Key Features

Agentic AI Investigation Workflow

Security incidents are processed through a coordinated multi-agent pipeline where each agent performs a specialized security function before passing context to the next stage.

Agents include:

Log Collection Agent
Detection Agent
MITRE ATT&CK Agent
Threat Intelligence Agent
Correlation Agent
Severity Escalation Agent
Case Management Agent
Investigation Agent

The workflow produces structured investigation outputs containing threat intelligence enrichment, MITRE ATT&CK mappings, escalation decisions, and analyst recommendations.

Threat Intelligence Enrichment

IP Reputation Analysis
Geographic Attribution
Threat Scoring
Risk Prioritization
Security Context Enrichment

MITRE ATT&CK Integration

The platform maps security events to MITRE ATT&CK techniques and tactics, helping analysts understand attacker behavior and investigation priorities.

Attack Type	MITRE ATT&CK Technique
SQL Injection	T1190 – Exploit Public-Facing Application
Brute Force	T1110 – Brute Force
XSS	T1059 – Command and Scripting Interpreter

Case Management

Case Creation
Case Search
Analyst Notes
Investigation Updates
Escalation Decisions
Severity Tracking
Investigation History

Security Monitoring Dashboard

Security Overview Metrics
Incident Tracking
AI Escalated Cases
Threat Intelligence Panel
MITRE ATT&CK Context
Executive Dashboard
Threat Hunting Workspace
Interactive Investigation Portal

Architecture

flowchart TD
    A[Windows Logs] --> G[Log Collection]
    B[Linux Logs] --> G
    C[AWS Logs] --> G
    D[Azure Logs] --> G
    E[Firewall Logs] --> G
    F[Application Logs] --> G

    G --> H[Detection Engine]
    H --> I[Threat Intelligence]
    I --> J[MITRE ATT&CK Mapping]
    J --> K[Multi-Agent Workflow]
    K --> L[Case Management]
    L --> M[FastAPI Services]
    M --> N[React Dashboard]

Multi-Agent Investigation Workflow

flowchart TD
    A[Security Event] --> B[Log Collection Agent]
    B --> C[Detection Agent]
    C --> D[MITRE ATT&CK Agent]
    D --> E[Threat Intelligence Agent]
    E --> F[Correlation Agent]
    F --> G[Severity Escalation Agent]
    G --> H[Case Management Agent]
    H --> I[Investigation Agent]
    I --> J[Final Investigation Report]

Security Capabilities

Threat Detection

SQL Injection Detection
Brute Force Detection
Cross-Site Scripting (XSS) Detection
API Abuse Detection
Session Hijacking Detection
Correlated Multi-Vector Attacks

Investigation & Response

Incident Correlation
Threat Prioritization
Severity Escalation
Investigation Tracking
Analyst Notes
Executive Reporting

AI Technologies

Agentic AI

The platform uses a coordinated multi-agent architecture where specialized agents collaborate to investigate security incidents and generate investigation outcomes.