# Autonomous SOC Analyst Agent

A Human-Gated Autonomous Security Operations Center (SOC) Analyst Agent designed to assist with security alert analysis, investigation, risk assessment, and response recommendations.

## Project Architecture

Security Sources

→ Alert Ingestion

→ Rulebook / SOC Use Cases

→ Initial Alert Filtering

→ Tiny CyberLLM

→ Alert / IOC / Log Analysis

→ Alert Correlation

→ Threat Enrichment

→ RAG

→ Qwen

→ Risk Assessment

→ Severity Classification

→ Evidence & Decision Validation

→ TP / FP / Uncertain

→ Investigation

→ Response Recommendations

→ Human Gate

→ Response Engine

→ Incident Report

→ Analyst Feedback

→ Continuous Improvement

## Technology Stack

- Wazuh

- Python

- PyTorch

- Custom Transformer / Tiny LLM

- Qwen

- FAISS

- FastAPI

- PostgreSQL

- Redis

- React

- Tailwind CSS

- Docker / Docker Compose

- Prometheus

- Grafana

## Project Status

Development in progress.

## License

Academic project.