AI SOC Agent
Blackhat 2025 presentation and codebase: AI SOC agent & MCP server for automated security investigation, alert triage, and incident response. Integrates with ELK, IRIS, and other platforms.
What is AI SOC Agent?
AI SOC Agent is a Model Context Protocol (MCP) server that allows AI assistants like Claude, Cursor, and VS Code to blackhat 2025 presentation and codebase: ai soc agent & mcp server for automated security investigation, alert triage, and incident response. integrates with elk, iris, and other platforms.
Blackhat 2025 presentation and codebase: AI SOC agent & MCP server for automated security investigation, alert triage, and incident response. Integrates with ELK, IRIS, and other platforms.
This server falls under the Security category on MCPgee, the world's largest MCP server directory with 33,000+ servers.
Features
- Blackhat 2025 presentation and codebase: AI SOC agent & MCP
Use Cases
Maintainer
Works with
Installation
Manual Installation
npx ai-soc-agentConfiguration
Configuration Details
claude_desktop_config.json
Performance
Response Metrics
Resource Usage
How to Set Up and Use AI SOC Agent
The AI SOC Agent MCP server (SamiGPT) is a Python-based Security Operations Center automation platform that integrates with SIEM systems like Elasticsearch, case management tools like IRIS and TheHive, and EDR platforms to automate alert triage, security investigation, and incident response. Presented at Blackhat 2025, it exposes AI-driven agent profiles (SOC1 triage, SOC2 deep investigation) through MCP so that Claude can act as an intelligent analyst, pulling context from threat intelligence and executing response playbooks. Security teams use it to reduce manual investigation time to roughly 50 seconds per alert at approximately $0.18 per investigation.
Prerequisites
- Python 3.9 or higher with pip and virtualenv
- An MCP-compatible client such as Claude Desktop or Cursor IDE
- Access to a SIEM platform (Elasticsearch/ELK) and credentials configured in config.json
- Case management system access (IRIS or TheHive) with API credentials
- Optional: EDR platform credentials and threat intelligence source (OpenCTI) access
Clone the repository
Clone the AI-SOC-Agent repository from GitHub and navigate into the project directory.
git clone https://github.com/M507/AI-SOC-Agent.git
cd AI-SOC-AgentCreate and activate a virtual environment
Create a Python 3.9+ virtual environment to isolate dependencies, then activate it.
python3 -m venv venv
source venv/bin/activateInstall dependencies
Install all required Python packages listed in requirements.txt.
pip install -r requirements.txtConfigure integrations
Copy the example configuration file and fill in your SIEM, case management, EDR, and threat intelligence credentials. The config.json file holds all integration settings including Elastic host/port, IRIS API keys, TheHive URL, and EDR platform details.
cp config.json.example config.json
# Edit config.json with your integration credentialsAdd the MCP server to your client configuration
Register the MCP server with your MCP client (Claude Desktop or Cursor). The server is launched by running the Python module directly.
Verify the server starts
Test that the MCP server starts correctly before connecting your client.
python -m src.mcp.mcp_serverAI SOC Agent Examples
Client configuration
Add this block to your Claude Desktop config file at ~/Library/Application Support/Claude/claude_desktop_config.json (macOS) or %APPDATA%\Claude\claude_desktop_config.json (Windows). Replace the cwd path with the absolute path to your cloned repository.
{
"mcpServers": {
"ai-soc-agent": {
"command": "python",
"args": ["-m", "src.mcp.mcp_server"],
"cwd": "/absolute/path/to/AI-SOC-Agent"
}
}
}Prompts to try
Once connected, use these prompts to interact with your SOC environment through Claude.
- "Execute the SOC1 triage agent on alert-123 and classify its severity"
- "Search for events from source IP 10.0.0.50 in the last 24 hours in Elasticsearch"
- "List all open cases in IRIS and summarize the highest severity ones"
- "Isolate endpoint host-workstation-42 and collect its running processes and network connections"
- "Enrich the IOC 185.220.101.45 with threat intelligence and check its reputation"Troubleshooting AI SOC Agent
Server fails to start with import errors or missing module exceptions
Ensure you have activated the virtual environment (source venv/bin/activate) before running the server, and that pip install -r requirements.txt completed without errors. Check Python version with python3 --version — it must be 3.9 or higher.
SIEM or case management tools return connection errors
Verify your config.json values are correct — especially the Elastic host, port, and credentials. Test connectivity to each integration endpoint independently before relying on the MCP server to reach them.
Claude Desktop does not recognize the MCP server after configuration
Ensure the cwd path in your claude_desktop_config.json is an absolute path pointing to the repository root. Restart Claude Desktop after saving the config file, and check that python is available in the system PATH used by the launch environment.
Frequently Asked Questions about AI SOC Agent
What is AI SOC Agent?
AI SOC Agent is a Model Context Protocol (MCP) server that blackhat 2025 presentation and codebase: ai soc agent & mcp server for automated security investigation, alert triage, and incident response. integrates with elk, iris, and other platforms. It connects AI assistants to external tools and data sources through a standardized interface.
How do I install AI SOC Agent?
Follow the installation instructions on the AI SOC Agent GitHub repository. Clone the repo, install dependencies, and add the server config to your AI client.
Which AI clients work with AI SOC Agent?
AI SOC Agent works with all major MCP-compatible AI clients including Claude Desktop, Claude Code, Cursor, VS Code (GitHub Copilot), Windsurf, and Cline.
Is AI SOC Agent free to use?
Yes, AI SOC Agent is open source and available under the MIT license. You can use it freely in both personal and commercial projects.
AI SOC Agent Alternatives — Similar Security Servers
Looking for alternatives to AI SOC Agent? Here are other popular security servers you can use with Claude, Cursor, and VS Code.
Casdoor
★ 13.6kAn open-source Agent-first Identity and Access Management (IAM) /LLM MCP & agent gateway and auth server with web UI supporting OpenClaw, MCP, OAuth, OIDC, SAML, CAS, LDAP, SCIM, WebAuthn, TOTP, MFA, Face ID, Google Workspace, Azure AD
ghidraMCP
★ 9.0kAn Model Context Protocol server that enables LLMs to autonomously reverse engineer applications by exposing Ghidra's decompilation and analysis tools. It allows AI agents to list code structures, rename methods, and analyze binaries directly through
HexStrike AI
★ 8.9kHexStrike AI MCP Agents is an advanced MCP server that lets AI agents (Claude, GPT, Copilot, etc.) autonomously run 150+ cybersecurity tools for automated pentesting, vulnerability discovery, bug bounty automation, and security research. Seamlessly b
IDA Pro MCP
★ 8.7kEnables AI-assisted reverse engineering in IDA Pro by providing tools to analyze binaries, decompile functions, manage comments, search patterns, and interact with the IDA database through natural language.
Anthropic Cybersecurity Skills
★ 6.6k754 structured cybersecurity skills for AI agents · Mapped to 5 frameworks: MITRE ATT&CK, NIST CSF 2.0, MITRE ATLAS, D3FEND & NIST AI RMF · agentskills.io standard · Works with Claude Code, GitHub Copilot, Codex CLI, Cursor, Gemini CLI & 20+ platform
Hooker
★ 5.1k🔥🔥 hooker is a Frida-based reverse engineering toolkit for Android. It offers a user-friendly CLI, universal scripts, auto hook generation, memory roaming to detect activities/services, one-click SOCKS5 proxy setup, Frida JustTrustMe, and BoringSSL u
Browse More Security MCP Servers
Explore all security servers available in the MCPgee directory. Each server includes setup guides for Claude, Cursor, and VS Code.
Set Up AI SOC Agent in Your Editor
Choose your AI client for step-by-step setup instructions.
Quick Config Preview
Add this to your claude_desktop_config.json or .cursor/mcp.json
Ready to use AI SOC Agent?
Browse our complete directory of 33,000+ MCP servers, read setup guides for your editor, and start building with the Model Context Protocol.