← Back to work
xAI · 2025

Security incident-response agent

The agent investigates an anomaly, calls tools, and proposes an action inside a conversation-first workspace.

  • Agentic tool calling
  • FastAPI
  • Python
  • React
  • TypeScript
Problem

Security operations work is triage under time pressure: an anomaly fires, and an analyst has to pull context from half a dozen tools, form a theory about what happened, and decide whether it warrants action. The same investigative loop, dozens of times a shift, mostly on alerts that turn out to be nothing.

The interaction decision

Let the agent run the investigative loop and arrive with a hypothesis already backed by evidence, but never let it act on its own. The analyst's job shifts from gathering to judging, which only works if every claim the agent makes is traceable to the tool call that produced it. So the workspace is conversation-first, with the evidence trail attached rather than summarized away.

Architecture

An agent that executes tool calls against telemetry and enrichment sources, accumulates evidence into a structured hypothesis, and proposes a next action for review. Python and FastAPI services behind it; a React and TypeScript workspace that renders the investigation as a conversation with its evidence inline, built end to end.

What shipped

A working incident-response platform where analysts review reasoning instead of assembling it, processing incidents roughly 20% faster than the prior workflow.