AI-SOC-Agent (SamiGPT) is an intelligent security operations platform and MCP server designed to streamline incident response and threat detection workflows. By connecting to SIEM platforms like Elastic, case management systems like IRIS and TheHive, EDR solutions, and threat intelligence sources, it equips AI agents and human analysts with vendor-neutral automation tools. The platform supports multi-tiered SOC runbooks, deep artifact correlation, and human-in-the-loop approval queues to accelerate alert triage while maintaining operational control.
主要功能
01Enrichment workflows incorporating threat intelligence feeds and NetBox DCIM/IPAM context
02Automated alert triage and deep case investigation across SOC1 and SOC2 tiers
03Human-in-the-loop review and approval queue for sensitive response actions
04Model Context Protocol (MCP) server exposing security tools to Open WebUI and LLM platforms
0553 GitHub stars
06Vendor-neutral integrations for SIEM (Elastic), Case Management (IRIS, TheHive), and EDR
使用案例
01Executing controlled endpoint containment actions through an agentic approval pipeline
02Automating initial SOC1 alert intake, enrichment, and false-positive filtering
03Conducting deep-dive SOC2 forensic investigations across SIEM logs and endpoint telemetry