SOC AutoPilot — Autonomous AI agent that investigates Splunk security alerts in under 2 minutes
SOC teams are overwhelmed by alert fatigue: analysts receive an average of 2,992 alerts per day, and 42% go uninvestigated. Breaches often begin in that gap, when real threats are buried under repetitive noise, false positives, and manual triage backlogs. SOC AutoPilot helps close the gap by automating the first-pass investigation workflow.
- Extract IOCs from the alert description, including IP addresses, usernames, and domains.
- Check the knowledge base for similar past investigations and known false-positive patterns.
- Pull live logs from Splunk using Splunk MCP-compatible REST queries.
- Classify the threat with AI using Gemini Flash and available log context.
- Generate an investigation report with findings, verdict, severity, recommended actions, and SPL.
- Save the investigation to the local knowledge base for future learning and analyst feedback.
[Demo GIF coming soon]
YouTube video: Coming soon
- Autonomous 6-step investigation pipeline
- Splunk MCP Server integration for live log queries
- Gemini Flash AI for threat classification
- Self-learning knowledge base (remembers past investigations)
- False positive detection from historical patterns
- Auto-generates SPL detection rules
- Analyst feedback loop
- Supports multiple AI backends (Gemini supported; Groq, Ollama planned)
SOC AutoPilot connects to Splunk via the Splunk REST API (/services/search/jobs) using basic auth (username/password). This is compatible with the Splunk MCP Server app on Splunkbase, which exposes the same REST endpoints. The mcp Python package is included in requirements.txt for future native MCP transport support.
- Python 3.10+
- Git
git clone https://github.com/Santhosh595/SOC-AutoPilot.git
cd SOC-AutoPilotinstall.batCopy .env.example to .env and fill in your credentials:
copy .env.example .env # Windows
# or
cp .env.example .env # macOS / LinuxGEMINI_API_KEY=your_key_here
SPLUNK_TOKEN=your_token_hereGet a free Gemini API key from Google AI Studio.
No keys? No Splunk? Set
demo_mode: trueinconfig.yaml— the LLM step is skipped gracefully and the pipeline runs on extracted IOCs with safe defaults. Splunk connectivity problems never crash the agent.
Set demo_mode: false in config.yaml, install the Splunk MCP Server app from
Splunkbase, then add your Splunk token to .env.
Test Splunk connectivity:
python main.py testInvestigate an alert:
python main.py investigate "Brute force attempt from 185.220.101.45 against admin account"View investigation history:
python main.py historyAdd analyst feedback:
python main.py feedback --id 1 --verdict FALSE_POSITIVE --note "Known scanner"| Backend | Status | Setup |
|---|---|---|
| Gemini | ✅ Default | Add GEMINI_API_KEY to .env, set ai.provider: gemini in config.yaml. |
| Groq | 🔜 Planned | Not yet implemented — llm_adapter.py currently accepts Gemini only. |
| Ollama | 🔜 Planned | Not yet implemented — llm_adapter.py currently accepts Gemini only. |
SOC AutoPilot can automatically alert you over Slack and/or Email when a MALICIOUS threat with CRITICAL or HIGH severity is detected.
- In your Slack workspace go to Settings → Manage apps → Incoming Webhooks.
- Create a new webhook, pick a channel, and copy the URL.
- Paste the URL into
config.yaml:notifications: slack_webhook: "https://hooks.slack.com/services/T.../B.../xxxx"
- Enable 2-Step Verification on your Google account.
- Go to myaccount.google.com/apppasswords and generate an App Password for "Mail".
- Add to
.env:SMTP_PASSWORD=your_app_password_here
- Fill in
config.yaml:notifications: email_to: "soc-team@company.com" email_from: "your.gmail@gmail.com" smtp_host: smtp.gmail.com smtp_port: 587
Note: Both channels are optional. If neither is configured the investigation still completes — notifications are simply skipped.
Splunk Agentic Ops Hackathon 2026 — Security Track
MIT