An AI agent that performs SOC tier 1 level analysis in a Wazuh shop.
- The Agent: A Python-based LangGraph agent running in a Docker container
- The Outcome: When Wazuh detects a threat, the Agent analyzes the alert, determines the risk, and pings a Slack channel with the detailed analysis.
- AI Agent: LangGraph, FastAPI, OpenAI (GPT-4o-mini)
- Docker version v29+
- An OpenAI API Key and Slack Webhook URL.
- Launch the AI Agent:
docker compose up -d --build
- Configure Wazuh to forward alerts (Level 8+) to your AI Agent's IP on port
8000.
The primary objective of this project is to learn the mechanics of Agentic AI conducting tier 1 level analysis. By placing an agent in a live security environment, I can test how it handles multi-step reasoning, manages "memory" of past events, and interacts with external tools to solve real-world problems.