Securityclaw Autonomous Soc Agent

This is a complete autonomous SOC framework that combines RAG-based threat detection with LLM analysis over OpenSearch or Elasticsearch data. It runs scheduled skills like network baselining every 6 hours and can poll for anomalies every minute, then uses retrieval-augmented context to validate threats through a LangGraph orchestration loop. The skill-based architecture means you can write new detections as isolated Python modules with LLM instruction files. Ships with both a React web UI and CLI for investigations, plus an onboarding wizard that configures your database connections and LLM provider. If you're already running Ollama locally and have security logs in OpenSearch, you can have an AI analyst watching your environment in about 10 minutes. The code is genuinely modular and lets you swap providers without refactoring core logic.

Install to Claude Code

npx -y skills add aradotso/security-skills --skill securityclaw-autonomous-soc-agent --agent claude-code