main
mdx 431 lines 17.8 KB
Raw
1 ---
2 title: AI Analyst (Talon)
3 description: Automated Tier 1 SOC analyst that investigates every alert end-to-end — from raw SIEM events to structured investigation reports with severity assessments and recommended actions.
4 ---
5
6 Talon is an automated AI SOC analyst built by [SOCFortress](https://www.socfortress.co/) for CoPilot. It runs as a background service alongside CoPilot — pulling raw events from your Wazuh/OpenSearch SIEM, enriching them with threat intelligence, correlating across your environment, and writing structured investigation reports with severity assessments and recommended actions directly back into CoPilot.
7
8 <Card title="GitHub Repository" icon="github" href="https://github.com/taylorwalton/talon">
9 Source code, deployment guide, and architecture docs.
10 </Card>
11
12 ---
13
14 ## What it does
15
16 - **Automated Tier 1 investigations** — every OPEN alert is investigated end-to-end: SIEM raw event → IOC extraction → VirusTotal / Shodan / AbuseIPDB → MITRE ATT&CK correlation → structured report
17 - **Two trigger paths** — real-time via `POST /investigate` (CoPilot calls this when an alert is created) and a 15-minute scheduled sweep as a safety net
18 - **Writes back to CoPilot** — job status, full report, and enriched IOCs are persisted in CoPilot's database via its REST API; no direct database writes
19 - **Privacy-aware by default** — an anonymizing MCP proxy intercepts raw SIEM events and replaces PII (usernames, hostnames, internal IPs) with session tokens before they reach the cloud model; a built-in deanonymize tool restores real values in the final report
20 - **Optional local LLM analysis** — if [Ollama](https://ollama.com/) is running, the agent routes raw event interpretation through a local model instead of the cloud; no config needed if Ollama is on the same host
21 - **Alert-type prompt templates** — per-alert-type investigation guides (Sysmon Event 1, 3, 7, 11, 22) are loaded automatically based on the alert's `rule.groups` field; add new templates without touching code
22
23 ---
24
25 ## How it works
26
27 ### Step 1 — Alert ingestion
28
29 Talon picks up OPEN alerts via two paths:
30 1. **Real-time webhook**: CoPilot calls `POST /investigate` when an alert is created
31 2. **Scheduled sweep**: Every 15 minutes, Talon queries the CoPilot database for OPEN alerts with no existing investigation job
32
33 ### Step 2 — SIEM correlation
34
35 Talon queries OpenSearch/Wazuh for:
36 - The raw event that triggered the alert
37 - Correlated events across the same asset, time window, and rule groups
38 - Historical context from the 30-day lookback period
39
40 ### Step 3 — IOC extraction & enrichment
41
42 IOCs (IPs, file hashes, domains, user accounts, commands) are extracted from the raw events and enriched via:
43 - **VirusTotal** — file hash and domain reputation
44 - **Shodan** — IP exposure and service enumeration
45 - **AbuseIPDB** — IP abuse reports
46
47 ### Step 4 — Report generation & write-back
48
49 Talon generates a structured investigation report containing:
50 - Executive summary
51 - Attack timeline
52 - IOC analysis with verdicts
53 - SIEM correlation findings
54 - Severity assessment with justification
55 - Recommended actions
56
57 The report, job status, and enriched IOCs are written back to CoPilot via the CoPilot MCP server.
58
59 ---
60
61 ## Architecture
62
63 ```
64 ┌──────────────────────────────────────────────────────┐
65 │ CoPilot (FastAPI) │
66 │ │
67 │ Alert created → POST /investigate ──────────────┐ │
68 │ GET /status, GET /jobs/:alertId ← Talon HTTP API│ │
69 │ │ │
70 │ Write-back API (MCP tools): │ │
71 │ POST /api/ai_analyst/jobs ←───────────┘ │
72 │ POST /api/ai_analyst/reports │
73 │ POST /api/ai_analyst/iocs │
74 │ MySQL: ai_analyst_job / report / ioc │
75 └───────────────────────┬──────────────────────────────┘
76 │ read-only MCP ▲ REST write-back
77 ▼ │
78 ┌──────────────────────────────────────────────────────┐
79 │ Talon (Node.js) │
80 │ │
81 │ HTTP channel (port 3100) │
82 │ POST /investigate ← CoPilot triggers this │
83 │ POST /message ← ad-hoc analyst prompts │
84 │ GET /status ← queue + job overview │
85 │ │
86 │ Scheduled task (every 15 min) │
87 │ Queries MySQL for OPEN alerts with no job row │
88 │ Runs full investigation per alert │
89 │ │
90 │ SOC agent (containerized) │
91 │ groups/copilot/CLAUDE.md ← investigation flow │
92 │ groups/copilot/prompts/ ← per-alert templates │
93 └──────────────────────────────────────────────────────┘
94 │ MCP tools (read-only)
95
96 ┌──────────────────────────────────────────────────────┐
97 │ opensearch-mcp — raw SIEM queries │
98 │ opensearch_anon — anonymizing proxy (PII→tokens) │
99 │ mysql-mcp — CoPilot DB (alerts, assets) │
100 │ copilot-mcp — CoPilot REST API write-back │
101 │ ollama (optional) — local LLM for sensitive data │
102 │ mempalace — persistent investigation memory │
103 └──────────────────────────────────────────────────────┘
104 ```
105
106 ---
107
108 ## Privacy & anonymization
109
110 Raw SIEM events contain sensitive data — usernames, internal hostnames, RFC1918 IPs. Talon's anonymizing MCP proxy intercepts all document and search results before they reach the Claude cloud API and replaces known PII fields with consistent session tokens:
111
112 | Token pattern | What it replaces |
113 |---------------|------------------|
114 | `USER_1`, `USER_2`, … | Usernames, account names |
115 | `HOST_1`, `HOST_2`, … | Hostnames, computer names |
116 | `IP_INT_1`, … | Internal / RFC1918 IP addresses |
117 | `EMAIL_1`, … | Email addresses |
118
119 Security-critical values — file hashes, external IPs, domains, process paths, rule metadata — pass through unchanged so threat intel lookups work normally. Before the final report is written, the agent calls a built-in `deanonymize` tool to restore real names and IPs so the analyst sees accurate output.
120
121 Field definitions live in `siem/anon_proxy/fields.yaml` — add new fields and deploy to extend coverage.
122
123 ---
124
125 ## Local LLM support (Ollama)
126
127 If [Ollama](https://ollama.com/) is running on the same host, Talon automatically routes raw event interpretation through a local model rather than the cloud. This keeps the most sensitive step — reading the full raw event and extracting IOCs — entirely on-premises.
128
129 The agent checks for Ollama at startup. If it's not running, the investigation continues without it — no errors, no configuration required.
130
131 ### Deployment options
132
133 | Option | Hardware | Cost | Privacy |
134 |--------|----------|------|---------|
135 | **Local Ollama** | GPU required | $0 (sunk) | Best (fully on-prem) |
136 | **RunPod cloud GPU** | None | ~$0.20–0.44/hr | Good (PII already tokenized) |
137 | **Skip (cloud only)** | None | Per-investigation | Good (anonymized before cloud) |
138
139 ---
140
141 ## MemPalace persistent memory
142
143 MemPalace gives the SOC agent long-term memory — past investigation outcomes, asset metadata, confirmed false positives, and IOC history are stored in a local ChromaDB + SQLite knowledge graph and retrieved automatically at the start of each investigation.
144
145 This allows Talon to:
146 - Reference prior investigations for the same alert or asset
147 - Avoid redundant analysis for known-good patterns
148 - Track remediation status across repeated investigations
149
150 ---
151
152 ## CoPilot UI integration
153
154 ### AI Analyst page
155
156 Navigate to **Incident Management → AI Analyst** to access:
157
158 | Tab | Purpose |
159 |-----|---------|
160 | **Overview** | Live status, architecture, capabilities, and integration details |
161 | **Reports** | Browse all investigation reports across all alerts |
162 | **Talon Chat** | Ad-hoc analyst prompts with SSE streaming responses |
163
164 ### Alert-level integration
165
166 When you open any alert in **Incident Management → Alerts**:
167
168 1. The **AI Analyst** tab appears next to Overview — if an investigation report exists, it auto-selects as the default tab with a pulsing indicator dot
169 2. Reports show severity tag, summary, full markdown report, and recommended actions
170 3. If multiple investigations exist for the same alert, a dropdown lets you switch between them (most recent first)
171 4. The **"Investigate with AI Analyst"** button on the Overview tab triggers a new investigation on demand
172
173 ---
174
175 ## Alert-type templates
176
177 Investigation templates live in `groups/copilot/prompts/`. Each file is a plain-text guide with template variables that the agent fills in at runtime.
178
179 | File | Alert type |
180 |------|-----------|
181 | `sysmon_event_1.txt` | Process Creation (Sysmon Event 1) |
182 | `sysmon_event_3.txt` | Network Connection (Event 3) |
183 | `sysmon_event_7.txt` | Image Load / DLL (Event 7) |
184 | `sysmon_event_11.txt` | File Create (Event 11) |
185 | `sysmon_event_22.txt` | DNS Query (Event 22) |
186
187 To add a new alert type, create the corresponding `.txt` file — no code changes required. The agent detects the type from `rule.groups` in the raw event and loads the matching template automatically.
188
189 ---
190
191 ## Deployment
192
193 ### Prerequisites
194
195 - Docker
196 - Node.js 20+
197 - A running OpenSearch / Wazuh SIEM
198 - A running CoPilot instance (MySQL/MariaDB + FastAPI)
199 - A [Claude Code](https://claude.ai/download) OAuth token
200
201 ### Quick start
202
203 ```bash
204 git clone https://github.com/taylorwalton/talon.git talon
205 cd talon
206 npm install && npm run build
207 ```
208
209 Then configure credentials:
210
211 ```bash
212 # SIEM (OpenSearch)
213 bash siem/setup.sh
214
215 # CoPilot database
216 bash mysql/setup.sh
217
218 # CoPilot REST API
219 bash copilot-mcp/setup.sh
220
221 # MemPalace persistent memory
222 bash mempalace/setup.sh
223
224 # Build the agent container
225 CONTAINER_RUNTIME=docker ./container/build.sh
226 ```
227
228 See the full [deployment guide](https://github.com/taylorwalton/talon#deployment-guide) for detailed steps including OAuth token setup, mount allowlist configuration, systemd/launchd service setup, and Ollama integration.
229
230 ### Verify
231
232 ```bash
233 # Health check (unauthenticated)
234 curl http://localhost:3100/health
235
236 # Test SIEM connectivity
237 curl -s -N -X POST http://localhost:3100/message \
238 -H "Content-Type: application/json" \
239 -H "x-api-key: $TALON_API_KEY" \
240 -d '{"message": "Check cluster health", "sender": "test"}'
241 ```
242
243 ---
244
245 ## Key source files
246
247 | File | Purpose |
248 |------|---------|
249 | `src/index.ts` | Orchestrator: message loop, agent invocation |
250 | `src/channels/http.ts` | HTTP channel: /investigate, /status, /jobs, /message |
251 | `src/task-scheduler.ts` | 15-minute scheduled alert sweep |
252 | `src/container-runner.ts` | Spawns agent containers with mounts |
253 | `groups/copilot/CLAUDE.md` | SOC agent investigation workflow |
254 | `groups/copilot/.mcp.json` | MCP server registry (opensearch, mysql, copilot, ollama) |
255 | `siem/anon_proxy/anon_proxy.py` | Anonymizing MCP proxy |
256 | `siem/anon_proxy/fields.yaml` | PII field definitions |
257 | `container/Dockerfile` | Agent container image |
258
259 ---
260
261 ## Per-deployment configuration
262
263 | Path | Purpose |
264 |------|---------|
265 | `siem/.env` | OpenSearch credentials |
266 | `mysql/.env` | CoPilot MySQL credentials |
267 | `copilot-mcp/.env` | CoPilot REST API credentials |
268 | `ollama/.env` | Optional Ollama host override |
269 | `mempalace-data/` | MemPalace palace data (ChromaDB + SQLite) |
270 | `.env` | Claude OAuth token, webhook URL, HTTP API key |
271 | `groups/copilot/CLAUDE.md` | SOC agent identity, known assets, ongoing investigations |
272 | `groups/copilot/prompts/` | Per-alert-type investigation templates |
273 | `siem/anon_proxy/fields.yaml` | PII field definitions for the anonymizing proxy |
274
275 ---
276
277 ## Safety & guardrails
278
279 - **Containerized isolation**: Each investigation runs in an isolated Linux container with a mount allowlist controlling file system access
280 - **No direct DB writes**: All data is written back via the CoPilot REST API with proper authentication
281 - **PII anonymization**: Sensitive data is tokenized before reaching any cloud model
282 - **Treat output as a draft**: AI-generated reports should be reviewed by an analyst before action
283 - **RBAC enforcement**: All CoPilot API endpoints require `admin` or `analyst` scope
284
285 ---
286
287 ## Video context
288
289 - AI analyst (alert-context + exclusion-rule assistance): https://www.youtube.com/watch?v=-2srPC-Dw-0
290 - AI chatbot + MCP-style "chat with your stack": https://www.youtube.com/watch?v=FHjD9QBaLD4
291 - Expanded AI companion features: https://www.youtube.com/watch?v=QaLrmSgEcLI
292 ---
293 title: AI analyst / AI-assisted investigation
294 description: AI-assisted workflows to speed up alert triage, investigation, and knowledge capture across your open-source SIEM stack.
295 ---
296
297 CoPilot’s AI features are designed to reduce context switching and speed up common SOC workflows:
298 - understand an alert faster ("what am I looking at?")
299 - decide what to do next ("benign or investigate?")
300 - generate drafts for repetitive engineering tasks (exclusions/tuning)
301 - chat with your stack (Wazuh, Velociraptor, CoPilot) using natural language
302
303 ---
304
305 ## What it is
306
307 In the videos, AI in CoPilot shows up in two main ways:
308
309 ### 1) AI analyst (alert-focused)
310
311 AI analyst is embedded directly into CoPilot’s alert experience.
312
313 Typical flow:
314 1) Open an alert
315 2) Select the impacted asset/hostname
316 3) Use **AI analyst** to generate context and suggested next steps
317
318 It can help:
319 - summarize what triggered the detection
320 - explain why the behavior can be suspicious
321 - suggest what to validate next (triage steps)
322
323 The same area can also support workflows like drafting **Wazuh exclusion rules** for noisy/expected behavior.
324
325 ### 2) AI chatbot / “chat with your stack” (tool-assisted)
326
327 CoPilot can expose an AI chatbot that can interface with:
328 - **Wazuh Manager**
329 - **Wazuh Indexer (OpenSearch)**
330 - **Velociraptor**
331 - **CoPilot**
332
333 This makes it possible to ask questions like:
334 - “show me recent alerts for customer X”
335 - “pull surrounding events for this index document”
336 - “run a Velociraptor artifact on host Y”
337
338 …and have CoPilot handle the underlying API/tool calls.
339
340 The chatbot can also be extended with additional “tools” (as shown in the videos), such as:
341 - threat intelligence lookups (IP/domain reputation)
342 - cyber news summaries
343 - internal knowledge base search/summarization
344 - high-level attack surface/exposure checks
345
346 ---
347
348 ## Why this is a power feature
349
350 AI assistance is most valuable after your core stack is stable:
351 - alerts are flowing
352 - assets/customers are properly scoped
353 - investigation pivots work (index_id/index_name, artifacts, cases)
354
355 Once that foundation is in place, AI can:
356 - reduce time-to-understanding for analysts
357 - standardize triage narratives
358 - accelerate tuning (without living in XML/rules all day)
359
360 ---
361
362 ## Operator workflows (practical)
363
364 ### Triage an alert faster
365
366 1) Open the alert and review key fields (command line, parent process, user, host)
367 2) Run **AI analyst** to get:
368 - a plain-English explanation of the detection
369 - what makes it suspicious
370 - recommended validation steps
371 3) Decide:
372 - escalate/investigate further, or
373 - mark as expected (and consider tuning)
374
375 ### Draft a Wazuh exclusion rule (noise reduction)
376
377 If an alert is expected/benign but noisy:
378 1) collect the key discriminators (image, command line pattern, user, parent, host group)
379 2) generate a draft exclusion rule
380 3) review it like code (avoid over-broad exclusions)
381 4) deploy + validate
382
383 ### Chat with your stack (investigation + response)
384
385 Use the chatbot when you want to do “SOC glue work” quickly:
386 - ask questions against recent alerts
387 - pivot into index logs for context
388 - run Velociraptor collections/artifacts without leaving CoPilot
389
390 ---
391
392 ## Setup checklist (high level)
393
394 Exact steps depend on your CoPilot release, but the videos show a common pattern:
395
396 1) **Update your CoPilot deployment**
397 - pull the latest images
398 - update `docker-compose.yml` with the new AI/MCP service (if required)
399
400 2) **Configure AI provider access**
401 - set your model provider API key(s) (example shown in the video: OpenAI)
402
403 3) **Configure stack connectivity for tool-assisted chat**
404 - Wazuh Indexer (OpenSearch) URL + credentials
405 - Wazuh Manager connection details (if used)
406 - Velociraptor connection details
407
408 4) **Validate permissions + scoping**
409 - ensure users can only summarize/ask questions over data they’re authorized to access (multi-tenant safety)
410
411 ---
412
413 ## Safety / guardrails
414
415 - Don’t paste secrets into prompts.
416 - Treat AI output as a draft: verify before acting.
417 - Be careful with exclusion rules: tune precisely to avoid blinding detections.
418 - Restrict access: AI can summarize sensitive customer data; enforce RBAC/tenant scoping.
419
420 ---
421
422 ## Video context
423
424 - AI analyst (alert-context + exclusion-rule assistance):
425 - https://www.youtube.com/watch?v=-2srPC-Dw-0
426
427 - AI chatbot + MCP-style “chat with your stack” (Wazuh/Indexer/Velociraptor/CoPilot):
428 - https://www.youtube.com/watch?v=FHjD9QBaLD4
429
430 - Expanded AI companion features (threat intel, cyber news, knowledge base search, exposure view):
431 - https://www.youtube.com/watch?v=QaLrmSgEcLI