rod-trent/siemtriage

SIEMTriage is a TypeScript-based AI agent that acts as a first-line security analyst for organizations using Microsoft Sentinel and Defender XDR, both are security monitoring platforms that generate alerts when suspicious activity is detected on a company's systems. The agent handles the routine, time-consuming work that junior analysts typically do manually: pulling in the alert details, gathering additional context about suspicious IPs, file hashes, and user accounts from external threat intelligence services, and running investigative database queries. Given a security incident ID, the agent automatically fetches the full incident, checks flagged IPs and domains against threat databases like VirusTotal and GreyNoise, looks up risky user accounts, and runs targeted log queries across both Sentinel and Defender. It then produces a structured verdict, essentially a classification of whether the incident is a real threat or a false alarm, along with a confidence score, a chain of evidence, and a recommended plan for a human analyst to follow up on. Critically, the agent never takes any action on its own: it only reads data and produces verdicts. A human analyst always makes the final call. The UI streams each step of the agent's reasoning in real time so analysts can watch and intervene. The repo ships with three realistic example incidents to demonstrate the full cycle. You can run it locally in demo mode with pre-computed results, or wire it to live Azure infrastructure. Built on the Claude Agent SDK, written in TypeScript, and requires Node.js, Postgres, and Redis. The full README is longer than what was provided.