Security tooling, threat intelligence platforms, and a catalog of vendor-specific AI agents for security operations.
This repository collects production-tested security engineering work spanning three areas: a real-time threat intelligence platform, a fleet of vendor-specific security operations agents, and vulnerability reporting tooling. The emphasis is on turning manual, repetitive security workflows into automated systems that surface signal instead of noise.
What's inside:
- 11 security AI agents — see the Agent Catalog
- Reusable AI skills — see the amazon-quick-skills repository
- CICC threat intelligence platform — full ingestion, enrichment, and scoring pipeline
The Cyber Intelligence Command Center — a real-time threat intelligence platform that aggregates CISA KEV, NVD, EPSS, and RSS feeds, enriches disclosures against a technology watchlist, and scores them into prioritized, actionable briefings. Includes the ingestion pipeline, interactive dashboard, executive briefings, and a design decisions write-up.
Seven vendor-specific subject matter expert agents covering the operational security stack: Splunk, Arctic Wolf, Microsoft Purview, SecurityScorecard, Darktrace, Palo Alto Networks, and SentinelOne. Each agent carries its own knowledge base (operational reference, query language guide, remediation playbooks). See the design decisions for the architecture rationale.
Vulnerability report summarization — transforms raw scan output (Nessus, Qualys, ZAP) into executive-ready reports with CVSS scoring and MITRE ATT&CK mapping.
Each subfolder is self-contained with its own README. Start with the CICC platform for the most complete end-to-end example, or browse the Agent Catalog to see the full range of security operations agents.
Built with Amazon Quick. Agents, skills, and automation pipelines were developed on the Amazon Quick platform and sanitized for public release.
MIT
Part of the SwooshJ-SecAI security and AI engineering portfolio.