About This Project

An AI-assisted threat hunting assistant for Microsoft Defender & Azure Log Analytics.

What It Does

Agentic SOC Analyst lets you ask security questions in plain English, such as:

“Has windows-target-1 had any suspicious logons in the last 3 days?”
  1. Natural language question comes in
  2. The model plans a table, fields, and time range
  3. Guardrails validate the plan against an allow-list
  4. The KQL query runs against Log Analytics
  5. The model analyzes results for threats

The agent determines which Log Analytics table, fields, and time range are relevant. Those choices are validated against an allow-list before the generated KQL query is allowed to run.

The returned logs are then analyzed for suspicious activity, mapped to MITRE ATT&CK, assigned a confidence level, and summarized with indicators of compromise and recommended actions.

About this public demo: the AI query planning and threat-hunt analysis you see here are real, live OpenAI calls. The underlying agent is built to run against a real Microsoft Defender / Azure Log Analytics workspace (that's what powers the local/CLI version of this tool) — but this hosted demo swaps that step for a small bundled sample dataset instead, so anyone can try it without querying live security telemetry or needing Azure credentials.

Credits

Threat Hunting Engine

The core AI threat-hunting logic, log analysis, guardrails, and model orchestration are based on code provided by Josh Madakor, founder of Cyber Range.

Web Application

The Flask web application, browser interface, backend integration, and SOC dashboard were built by David Pena.