TheSOCanalystthatprovesitswork.

The autonomous SOC analyst for Splunk. It writes its own SPL, grounds every verdict in real events, and contains the threat.

Incident ReportTrue Positive · High
Verdict
True Positive
High severity · IAM credential abuse
Confidence
0.94 / 1.0
high confidence
0.00.51.0
Risk factors
Verdict
Chain
Intel
Memory
Risk score
High
87/100
Risk
Attack timeline
web_admin used from 139.198.18.205
Valid cloud credentials from a China-based IP · T1078
09:14
637× RunInstances — all denied
Mass EC2 spin-up blocked by IAM policy · T1580
09:15
Cryptomining pattern confirmed
Resource hijacking via EC2 · T1496
09:17

Howitworks

One alert in, a contained incident out. Argus runs a real plan, act, observe, re-plan loop against live Splunk, proves the verdict, then closes the loop with a gated response and a new detection.

See it live
Plan · Act · Observe · Re-plan
MCP-native
01

Alert → Plan

Argus takes the notable, recalls its own past cases and active blocklist, then declares the leading hypotheses it will test before it runs a single query.

planning
02

Write SPL

It writes SPL on the fly and runs it through the Splunk MCP Server, the only way Argus ever touches Splunk.

querying
03

Observe → Pivot

It reads the result rows, confirms or refutes each hypothesis, and decides the next query. No hardcoded paths.

pivoting
04

Prove → Contain

It files a grounded report, contains the threat through a gated response, and installs a detection so it cannot recur.

hardening
Plan · act · observe · prove · contain · harden.
The full picture

One diagram, end to end

From the analyst's alert to a contained incident and a fresh detection, the whole Argus architecture in a single view.

Argus architecture — autonomous SOC investigation on Splunk
Open full view
Investigation tradecraft

Everystepananalystwouldtake

A full plan → act → observe → re-plan loop, run autonomously as a single agent or a four-specialist team — and it proves every claim it makes.

01

Grounded, provable reasoning

Every verdict links to the exact SPL Argus ran and the exact events it saw. Click any conclusion in the report to drill down to the query and the rows behind it.

02

Explicit hypothesis ledger

Argus declares its leading theories up front and marks each confirmed or refuted as evidence lands — so it tests alternatives instead of just confirming the first guess.

03

Institutional memory

Before and during every case Argus recalls its own past investigations and active blocklist — a repeat-offender indicator surfaces its prior verdict instantly, the way a veteran analyst would remember it.

04

Validated MITRE ATT&CK

Every technique ID is checked against a pinned ATT&CK v19.1 catalog of 858 techniques; hallucinated IDs are dropped, and the incident's tactics render as an ordered kill-chain.

05

Composite risk score

An explainable 0–100 score from verdict, confidence, severity, kill-chain breadth, live threat-intel and case history — built for real triage and prioritization, not just a severity label.

06

Self-hardening loop

After a confirmed true positive, Argus writes a new SPL detection for the attack pattern and installs it as a scheduled Splunk correlation search — so the SOC auto-alerts if it ever recurs.

1.0

Verdict AccuracyAcross 18 real investigations

0.99

Grounding PrecisionEvery reported IOC verified in-data

0

Invalid ATT&CK IDsValidated vs pinned ATT&CK v19.1

6

BOTS v3 Scenarios4 attacks + 2 precision controls · 18 runs

Triageshouldn'ttakeanhour

The bottleneck in the SOC isn't detection — it's the slow, manual, unprovable investigation that comes after the alert fires.

A Tier-1 analyst spends 30–60 minutes manually pivoting across Splunk to triage a single notable — and still has to write up why it's a threat.

Manual triage30–60 min per notable

Alert queues grow faster than analysts can work them, so real attacks sit in the backlog right next to the false alarms nobody had time to clear.

Alert fatigueThe backlog problem

When an AI finally flags something, you can't act on a verdict you can't audit — every conclusion needs the exact query and the exact events behind it.

Trust & auditProvable, or it doesn't ship

Runitthewaytheincidentneeds

One agent or a coordinated team, investigate-only or all the way to containment. Same engine, same grounded report — runs on the Anthropic API or AWS Bedrock.

Single-agent

One autonomous analyst that plans, queries, and proves — the core Argus loop.

Investigate
  • Plan → act → observe loop
  • Grounded incident report
  • Validated MITRE + kill-chain
  • Composite risk score
  • Live token-by-token streaming
Open dashboard

Multi-agent

Four specialists — auth, network, endpoint, threat-intel — investigate in parallel.

Correlate
  • Everything in single-agent
  • Four concurrent specialist lanes
  • Cross-source correlation
  • One synthesized attack narrative
  • Faster on complex incidents
Launch --multi

Respond & harden

Close the loop: contain the threat and leave a new detection behind.

Contain
  • Blocklist enforced by correlation search
  • Case recorded to memory
  • Slack / Jira tickets
  • Self-hardening detection-as-code
  • Human-approval gate (or --auto)
See the response phase

WatchArgusinvestigatelive

Submit an alert and watch the agent plan, run its SPL, mark its hypotheses, and reach a grounded verdict in real time — then drill into any claim to see the exact query and events behind it.

MCP-native by design

Argus only ever reads Splunk through the Splunk MCP Server — every query is auditable, and every conclusion links straight back to the events it saw. Nothing is asserted that the data can't prove.