Major project
Cybersecurity & Digital Trust
SOC triage and incident response agent
An agent that reads alerts, adds threat information, gathers logs, rates severity and drafts an incident report and containment steps for an analyst.
The brief
Security operations centres drown in alerts. Build an agent that reads an alert, enriches it with threat information, gathers related logs with read-only tools, rates its severity, and drafts an incident report and containment steps, which an analyst approves before anything happens. Good looks like: read-only tools, an approval step, scripted incidents from public data, and triage accuracy and cost per alert.
What you will build
- Build read-only tools: log search, threat lookup, asset lookup
- Build the agent with LangGraph and analyst approval
- Draft incident reports in a standard format
- Test on scripted incidents built from public datasets
- Measure triage accuracy, unsafe actions blocked and cost
- Defend the agent against prompt injection in logs
Free, open data to build it with
- CIC-IDS2017 ↗ Canadian Institute for Cybersecurity
- MITRE ATT&CK ↗ MITRE
Check each dataset's licence before you publish your work. Your mentor gives your team its own version of the brief (data, scope or region), so every team's project is its own.