Security Operations Agent

A demonstration of how agents can be useful in security operations.

Features

Tools

1. Elasticsearch Search - Search security events and logs using Elasticsearch query_string syntax
2. Elasticsearch Aggregations - Perform aggregations on security data for analysis
3. Kibana Detection Alerts - Aggregate and manage detection alerts from Kibana Security

Configuration

Environment Variables

• ANTHROPIC_API_KEY - Required. API key for Anthropic Claude
• ELASTIC_USER_API_KEY - Required. API key for Elasticsearch/Kibana authentication
• ELASTICSEARCH_URL - Required. URL of your Elasticsearch instance
• KIBANA_URL - Required. URL of your Kibana instance

Building

go build

Running

export ANTHROPIC_API_KEY="your-key"
export ELASTIC_USER_API_KEY="your-key"
export ELASTICSEARCH_URL="https://your-es-instance:9200"
export KIBANA_URL="https://your-kibana-instance:5601"

./security-operations-agent

Resources

• https://ampcode.com/how-to-build-an-agent
• https://github.com/Ingenimax/agent-sdk-go
• https://github.com/charmbracelet/bubbletea