An AI-powered threat hunting assistant that integrates with Azure Sentinel and VirusTotal to provide comprehensive security analysis. The tool pulls data directly from your Azure Log Analytics Workspace and enriches findings with threat intelligence.
- AI-Powered Threat Detection: Leverages GPT models for intelligent threat analysis
- Azure Sentinel Integration: Direct connection to your Log Analytics Workspace
- VirusTotal Integration: Automatic IOC reputation checking and threat intelligence
- MITRE ATT&CK Integration: Built-in knowledge of tactics, techniques, and procedures
- Multi-Model Support: Choose from 2 optimized AI models based on complexity and budget
- Comprehensive Analysis: MDE & MDO telemetry, user sign-ins, Azure Network Security Groups telemetry, and Sentinel incidents
- DeviceProcessEvents
- DeviceNetworkEvents
- DeviceLogonEvents
- DeviceFileEvents
- DeviceRegistryEvents
- AlertInfo
- AlertEvidence
- EmailEvents
- EmailAttachmentInfo
- EmailUrlInfo
- UrlClickEvents
- EmailPostDeliveryEvents
- SigninLogs
- AzureActivity
- AzureNetworkAnalytics_CL
- SecurityIncident
- Python 3.8+
- Azure CLI
- Azure Log Analytics Workspace ID
- API Keys: OpenAI, VirusTotal
git clone https://github.com/fyankov96/agentic-soc-analyst.git
cd agentic-soc-analyst
pip install -r requirements.txtInstallation:
- Windows: Download from https://aka.ms/installazurecliwindows
- macOS:
brew install azure-cli - Linux:
curl -sL https://aka.ms/InstallAzureCLIDeb | sudo bash
Authentication:
Run az login to authenticate with Azure
Add OpenAI, VirusTotal API keys and Log Analytics Workspace ID within secrets_.py
# Run the SOC Analyst
python main.py
"Can you give me an update on Sentinel Incident #10860 from 2 days ago? I'd like to know its current status"
"I'm worried that john.smith@example.com might be compromised. Can you take a look at the past 7 days of sign-in and audit activity?"
"Can you check SigninLogs for the past 2 hours and tell me if we've had any failed logins coming from locations that look unusual?"
Special thanks to Josh Madakor and his incredible Cyber Range Community for inspiring this project and fostering innovation in cybersecurity education and tooling.