soc-analyst-l1

Agentic L1 SOC analyst that triages SIEM alerts (Splunk, QRadar, Elastic, Sentinel, Wazuh), enriches with CrowdStrike, cites its reasoning, and learns from analyst corrections — self-hosted.

GitHub

Official source

Start locally with the CLI guide