13 specialized AI agents for different security operations tasks.

Tool Access

All agents have access to tools through two integration methods:

Agent SDK (Recommended - Web UI)

  • 19 Backend Tools via Claude API function calling
  • Security detections, case management, approvals, MITRE ATT&CK
  • Zero desktop dependency - Works entirely through the API
  • Production-ready for multi-user deployments
  • Enabled by default in web UI

MCP Tools (Optional - Advanced Use)

  • 100+ Extended Tools for specialized integrations
  • Requires additional MCP server configuration
  • Best for advanced local workflows or specialized integrations

Default Behavior: Agents automatically use backend tools via Agent SDK in the web UI with no additional configuration needed.

Quick Reference

Agent Speed Thinking Use When
Triage Fast No Prioritizing alert queue
Investigator Thorough Yes Deep-dive analysis
Threat Hunter Balanced Yes Proactive threat hunting
Correlator Balanced Yes Linking related alerts
Responder Fast No Immediate action items
Reporter Balanced No Documentation, reports
MITRE Analyst Balanced Yes ATT&CK technique mapping
Forensics Thorough Yes Artifact analysis
Threat Intel Balanced Yes IOC enrichment
Compliance Balanced No Policy/regulation checks
Malware Analyst Thorough Yes Malware analysis
Network Analyst Balanced Yes Traffic analysis
Auto-Responder Balanced Yes Autonomous actions

Workflows

These are executable multi-agent playbooks defined in the /workflows/ directory. Each workflow has a WORKFLOW.md file with YAML frontmatter metadata and detailed phase-by-phase instructions.

Workflows can be executed from the Workflows page in the UI or via the /api/workflows/{id}/execute API endpoint.

Workflow Agents Use Case Workflow File
Incident Response Triage -> Investigator -> Responder -> Reporter Active incident handling workflows/incident-response/WORKFLOW.md
Full Investigation Investigator -> MITRE Analyst -> Correlator -> Responder -> Reporter Deep-dive analysis with ATT&CK mapping workflows/full-investigation/WORKFLOW.md
Threat Hunt Hunt Lead over Threat Hunter, Network Analyst, Threat Intel Proactive hypothesis-driven hunting workflows/threat-hunt/WORKFLOW.md
Forensic Analysis Forensics -> Malware Analyst -> Network Analyst -> Reporter Post-incident forensics with chain of custody workflows/forensic-analysis/WORKFLOW.md

Threat Hunt is the one that is not a phase chain. It declares run_kind: hunt in its frontmatter, which routes it to the hypothesis loop: the definition states hypotheses, attack_techniques and data_domains, and a Hunt Lead decides each iteration what to do next from what the evidence has done to each belief. Its phases: block is a roster of who may be dispatched, not an order — the workers’ prompts and tool grants live in services/agent/arch/threathunt.yaml. The other four definitions are compose playbooks and walk their phases in order. A hunt run reports hypotheses and their standing where a compose run reports phase rows.

Adding Custom Workflows

Create a new directory under workflows/ with a WORKFLOW.md file:

workflows/
  my-custom-workflow/
    WORKFLOW.md    # YAML frontmatter + markdown workflow definition

The backend discovers workflows automatically on startup. Use POST /api/workflows/reload to pick up changes without restart.

Agent Capabilities

Triage Agent

  • Rapid alert assessment
  • Severity scoring
  • False positive identification
  • Escalation decisions

Investigator Agent

  • Root cause analysis
  • Evidence collection
  • Timeline reconstruction
  • Cross-source correlation

Threat Hunter Agent

  • Hypothesis-driven hunting
  • Anomaly detection
  • Pattern recognition
  • APT discovery
  • Pattern intelligence from 7,200+ detection rules
  • Field usage learning and correlation
  • Detection pattern extraction

Correlator Agent

  • Multi-stage attack detection
  • Campaign identification
  • Entity relationship mapping
  • Attack chain reconstruction

Responder Agent

  • Containment recommendations
  • NIST IR framework
  • Blast radius assessment
  • Remediation steps

Reporter Agent

  • Executive summaries
  • Technical reports
  • Audience-tailored content
  • Compliance documentation

MITRE Analyst Agent

  • Technique identification
  • Kill chain analysis
  • TTP mapping
  • Framework contextualization
  • Detection coverage analysis (71+ new tools)
  • Gap identification and prioritization
  • Detection template generation
  • Tribal knowledge documentation

Forensics Agent

  • Artifact analysis
  • Chain of custody
  • Multi-domain forensics
  • Evidence examination

Threat Intel Agent

  • IOC enrichment
  • Actor attribution
  • Campaign tracking
  • OSINT integration
  • Cloudflare context: cites finding.enrichment.threat_indicators (Cloudforce One STIX hits) as ground-truth edge-observed indicators; quotes finding.evidence.cloudy_summary verbatim with provenance when present. MCP tools: cf_lookup_ip_threat, cf_lookup_domain_threat.

Compliance Agent

  • NIST, ISO, PCI-DSS, HIPAA, GDPR, SOC 2
  • Policy validation
  • Control assessment
  • Audit preparation

Malware Analyst Agent

  • Static/dynamic analysis
  • Family classification
  • IOC extraction
  • C2 identification
  • Sandbox tools: CAPE (cape_*), Hybrid Analysis (ha_*), Any.Run (anyrun_*), URL analysis (url_analyze). Agents should cache-check via *_search_hash before submitting new detonations.

Network Analyst Agent

  • Flow analysis
  • Protocol examination
  • Lateral movement detection
  • Exfiltration identification
  • Cloudflare context tools: cf_lookup_ip_threat for C2/beaconing investigations.

Auto-Responder Agent

  • Confidence-based automation
  • Approval workflow integration
  • Autonomous containment
  • Human oversight for low-confidence
  • Cloudflare enforcement: proposes WAF_BLOCK (cf_waf_block_ip), GATEWAY_BLOCK (cf_gateway_block_domain), ACCESS_REVOKE (cf_access_revoke_session). All cf_* write actions route through services/approval_service.py; auto-approval requires confidence ≥ 0.90.

Approval Workflow Integration

All agents can submit actions to the approval queue:

Confidence Behavior
>= 0.90 Auto-approved, executed
0.85-0.89 Auto-approved with flag
0.70-0.84 Requires manual approval
< 0.70 Monitor only

Backend Tools by Agent (Agent SDK)

All agents use these tools via Claude API function calling:

Agent Primary Backend Tools
Triage list_findings, get_finding, create_case
Investigator All backend tools, nearest_neighbors, detection search
Threat Hunter nearest_neighbors, detection search, pattern intelligence
Correlator nearest_neighbors, technique_rollup, attack_layer
Responder create_approval_action, list_approval_actions, template generation
Reporter create_attack_layer, case export
MITRE Analyst technique_rollup, get_findings_by_technique, coverage analysis, gap identification
Forensics search_findings, evidence tools, detection search
Threat Intel Detection search, IOC analysis tools
Malware Analyst Detection search, pattern analysis, sandbox detonation (CAPE, Hybrid Analysis, Any.Run)
Network Analyst Detection search, traffic pattern tools
Auto-Responder correlate_and_create_action, approval tools, detection validation

Optional MCP Tools

For advanced workflows requiring external integrations (Splunk, VirusTotal, Shodan, etc.), see the MCP configuration guide in INTEGRATIONS.md.

Detection Engineering Tools (Security-Detections-MCP)

All agents have access to 71+ new detection engineering tools:

Category Available To Tools Count
Coverage Analysis MITRE Analyst, Investigator, Responder 6
Detection Search All Agents 12
Pattern Intelligence Threat Hunter, MITRE Analyst 15
Template Generation MITRE Analyst, Responder 8
Tribal Knowledge All Agents 20
Analytics & Reporting MITRE Analyst, Reporter 10

Total Tools: 71 detection engineering tools + 27 existing integrations = 98+ tools available

See DETECTION_ENGINEERING.md for detailed tool descriptions and workflows.

Usage Tips

  1. Match agent to task - Use the specialist for your need
  2. Switch freely - Change agents mid-conversation
  3. Start with Triage - When unsure where to begin
  4. End with Reporter - Document findings
  5. Use thinking agents - For complex analysis (Investigator, Hunter, Forensics)
  6. Use fast agents - For quick decisions (Triage, Responder)