What is Agentic SOC Platform

Agentic SOC Platform (ASP) is an open-source security operations platform that provides security teams with a complete workflow from alert ingestion, automatic aggregation, AI analysis to response disposition.

ASP places alerts, cases, entities, enrichment results, knowledge, and automation playbooks in the same workspace. Analysts no longer need to repeatedly switch tools around individual alerts, but instead review evidence, confirm AI reports, and make disposition decisions around Case.

Why Not Another SIEM/SOAR

ASP is not an AI chat entry point added on top of a traditional alert list, nor does it force users to express automation only through drag-and-drop flows or static configuration files. It keeps the workspace experience and security data model expected from mature SOAR platforms, while moving highly customized alert handling, investigation flows, and response actions into Python code.

ASP does not rebuild a separate, isolated agent system. Instead, it brings LLM analysis, Playbook automation, and Harness Agent capabilities into the same SOC workflow.

This means the analyst's work will change from "processing alerts one by one" to "reviewing AI analysis results and making final judgments." The platform is responsible for aggregating information, completing context, and advancing repetitive processes; humans are responsible for judging risk, confirming impact, and deciding response actions.

Unique Advantages

Advantage	Description
Workspace and data model	ASP provides UI/UX for daily SOC work and organizes workflows around Case, Alert, Artifact, Enrichment, Playbook, and Knowledge resources, staying close to mature SOAR best practices.
Code-first flexibility	Module and Playbook are written in Python and are not limited by drag-and-drop orchestrators or static configuration files. Users can fully express field normalization, correlation, context enrichment, external system integration, and response logic.
Better suited for agent-assisted development	Code-first customization raises the ceiling and would traditionally raise the development barrier. ASP uses Skills to help Harness Agents generate, modify, and validate Module / Playbook code, turning flexibility into lower implementation cost.
Harness Agent first	ASP exposes platform capabilities through CLI and Skills, prioritizing reuse of the user's existing Harness Agents instead of building an isolated agent system. Harness Agents can participate in SOC operations around Case, Artifact, SIEM logs, threat intelligence, Module, and Playbook.
Open source and private deployment	ASP uses the MIT license and supports single-node private deployment with Docker Compose, so security data can stay inside the internal network. Backend, frontend, extension scripts, and deployment flows remain clear for audit and customization.

From Alerts to Knowledge

Stage	What ASP does
Alert ingestion	Receives alerts from SIEM / Webhook / ELK Index Action and writes them to Redis Stream.
Module processing	Uses Python Module to extract IOCs, map fields, correlate signals, and generate Case / Alert / Artifact.
Case investigation	Lets analysts review evidence, discuss leads, inspect Timeline, and confirm risk judgments around Case.
AI analysis and enrichment	LLM generates investigation reports, while Playbook adds threat intelligence, CMDB context, knowledge extraction, and other automation results.
Harness Agent collaboration	Uses CLI and Skills to let Harness Agents query SIEM, operate resources, and write Module / Playbook code.
Knowledge capture	Extracts reusable experience from confirmed Cases and turns it into organization-level Knowledge.
Governance and collaboration	Uses users/API Keys, LDAP, Audit Log, and Inbox to support collaboration, audit, and access control.

ASP's core data model (Case, Alert, Artifact, Enrichment, Playbook, Knowledge) references mainstream SOAR / Agentic SOC platform workflows, ensuring the process is intuitive and universal for security teams.

Who Should Use

• Security operations teams that want to converge SIEM alerts into actionable Cases.
• Teams that want to use LLM in investigation, but also need audit, traceability, and manual decision-making.
• Teams that want to unify threat intelligence, assets, identity, history, and other context onto security resources.
• Teams that want to use Python for low-cost customization of alert processing logic and automation playbooks.
• Teams that want to let Harness Agents enter the security operations process.

Get Started

• Quick Deployment — Deploy ASP and start the basic workflow in the documentation.
• Skills — Let Harness Agents use ASP capabilities through asp-cli.
• Case Workspace — Learn how analysts handle security events around Case.
• Module Development — Learn how to use Module to stream process alerts.
• Playbook Development — Learn how to orchestrate LLM analysis and SOAR automation together.