Security incident-response agent
The agent investigates an anomaly, calls tools, and proposes an action inside a conversation-first workspace.
- Agentic tool calling
- FastAPI
- Python
- React
- TypeScript
Security operations work is triage under time pressure: an anomaly fires, and an analyst has to pull context from half a dozen tools, form a theory about what happened, and decide whether it warrants action. The same investigative loop, dozens of times a shift, mostly on alerts that turn out to be nothing.
Let the agent run the investigative loop and arrive with a hypothesis already backed by evidence, but never let it act on its own. The analyst's job shifts from gathering to judging, which only works if every claim the agent makes is traceable to the tool call that produced it. So the workspace is conversation-first, with the evidence trail attached rather than summarized away.
An agent that executes tool calls against telemetry and enrichment sources, accumulates evidence into a structured hypothesis, and proposes a next action for review. Python and FastAPI services behind it; a React and TypeScript workspace that renders the investigation as a conversation with its evidence inline, built end to end.
A working incident-response platform where analysts review reasoning instead of assembling it, processing incidents roughly 20% faster than the prior workflow.