c-zerooo/AegisAgent

AegisAgent Autonomous Multi-Agent Security Operations Center (SOC) AegisAgent is an Agentic AI-powered Security Operations Center (SOC) that demonstrates how multiple specialized AI agents can collaboratively investigate cybersecurity incidents using an orchestration-based architecture.

Instead of relying on a single reasoning engine, AegisAgent employs an Orchestrator Agent that coordinates multiple domain-specific agents to investigate alerts, correlate evidence, generate response recommendations, and produce a complete SOC investigation report.

The project is designed for educational purposes, workshops, and demonstrations of Agentic AI, Multi-Agent Systems, and Security Automation.

Features · Multi-Agent AI Architecture · Central Orchestrator Agent · Concurrent Agent Execution · Threat Intelligence Analysis · SIEM Log Investigation · Endpoint Investigation · User Behavior & Risk Analysis (UEBA) · Attack Correlation · Response Planning · Automated SOC Report Generation · FastAPI REST API · Live Investigation Streaming using Server-Sent Events (SSE) · Interactive Dashboard · Fully Offline Mock Security Environment · Ready for Future LLM Integration

System Architecture

Multi-Agent Architecture · Orchestrator Agent

The Orchestrator is the brain of the system.

Responsibilities: · Receives alerts · Launches investigation agents · Executes agents concurrently · Collects investigation results · Coordinates the workflow · Streams progress to the dashboard

· Threat Agent

Responsible for threat intelligence.

Uses: · IP Reputation · Threat Intelligence Database Outputs: · Reputation · Confidence · Threat Category · Threat Summary

· Log Agent

Responsible for SIEM investigation.

Uses: · Mock SIEM Logs Outputs: · Timeline · Related Events · Suspicious Activities · Event Summary

· Endpoint Agent

Responsible for endpoint investigation.

Uses: · Endpoint Inventory · Network Connections Outputs: · Endpoint Status · Hostname · Active Connections · Suspicious Communications

· Risk Agent

Responsible for User and Entity Behavior Analytics (UEBA).

Outputs: · Risk Score · Risk Level · Behavioral Factors

· Correlation Agent

Combines outputs from all investigation agents.

Responsibilities: · Attack Timeline · Credential Theft Detection · Lateral Movement Detection · Privilege Escalation Detection · Data Exfiltration Detection · MITRE ATT&CK Mapping · Incident Summary

· Response Agent

Analyzes the correlated evidence.

Generates: · Threat Severity · Threat Score · Recommended Actions · Human Approval Requirement

The Response Agent never executes destructive actions.

· Report Agent

Produces the final investigation report.

Generates: · Executive Summary · Timeline · Evidence · Threat Assessment · Recommendations · SOC Investigation Report

Project Structure

Investigation Workflow

Existing Security Tools The agents reuse the existing investigation tools.

Mock Data Sources The project runs completely offline using mock datasets. · Mock SIEM Logs · Threat Intelligence Database · Endpoint Inventory · Network Connections · User Risk Profiles

No external APIs are required.

API Endpoints Dashboard

Loads the SOC dashboard.

Alerts

Returns available investigation scenarios.

Investigate

Starts a complete multi-agent investigation and streams progress using Server-Sent Events (SSE).

Endpoints

Returns endpoint inventory.

Tools

Lists available investigation tools.

Live Streaming The investigation pipeline streams live events using Server-Sent Events (SSE).

Example sequence:

Installation Clone the repository:

Install dependencies:

Run the application:

Or specify a custom port:

Open your browser:

or

API Documentation:

Technologies Used · Python 3 · FastAPI · Uvicorn · Jinja2 · HTML5 · CSS3 · JavaScript · Server-Sent Events (SSE) · AsyncIO · Multi-Agent Architecture

Security Concepts Demonstrated · Security Information and Event Management (SIEM) · Endpoint Detection and Response (EDR) · Threat Intelligence · User and Entity Behavior Analytics (UEBA) · Attack Correlation · Threat Scoring · Human-in-the-Loop Decision Making · Security Orchestration

Future Enhancements · Integration with OpenAI, Gemini, or Xiaomi MiMo APIs · Retrieval-Augmented Generation (RAG) · Vector Database Support · Real SIEM Integration (Splunk, Microsoft Sentinel, Elastic) · VirusTotal & AbuseIPDB Integration · MITRE ATT&CK Knowledge Base · Memory-enabled Agents · Persistent Investigation History · Docker Deployment · Kubernetes Support · Authentication & RBAC · PDF Report Export · Email & Slack Alerting

Project Goals · Demonstrate Multi-Agent AI systems · Simulate SOC investigations · Showcase orchestration-based agent collaboration · Provide a reusable architecture for Agentic AI security applications · Serve as an educational platform for AI-driven cybersecurity

License This project is intended for educational and research purposes. You may modify and extend it for learning, demonstrations, or workshops.

Author Lakshya

Built as an Agentic AI Multi-Agent Security Operations Center (SOC) demonstrating orchestration, concurrent agent execution, and AI-assisted cybersecurity investigations.