SIEM Alert Narrator

What it does

SIEM Alert Narrator is a read-only SOC/SecOps triage agent. It pulls security alerts from a SIEM (Datadog or a generic read API) READ-ONLY, runs a deterministic triage core — normalize, map severity, correlate and group by signature + source, suppress noise/flapping, and priority-score — then uses an LLM ONLY to synthesize an analyst-friendly narrative (what happened / why it matters / suggested next step). Every count, severity, and source is code-derived; the model never invents numbers and never asserts a definitive cause. Without an API key (and no host sampling) it degrades gracefully to a deterministic template. Read-only by construction (GET-only; no mute/close/action endpoints). Gated: live SIEM access needs credentials (Datadog API + app key, or a generic SIEM bearer token); with none provided it runs entirely on mock alert fixtures or your own caller-provided alerts — so you can try it offline with zero setup. Guardrails: read-only, egress allowlisted to the SIEM host, PII/source masking, API-key non-leak, prompt-injection defang on all alert text, no fabrication (no alerts ⇒ empty triage), and advisory-only recommendations. Tools: - run_full — end-to-end: fetch (read-only), normalize, correlate/triage, narrate, return the full result JSON. - fetch_alerts — fetch raw alerts from the connector (read-only; mock/provided offline), no triage. - normalize_alerts — deterministic normalization: severity mapping, PII masking, text sanitization, severity_min filter (no LLM). - correlate_and_triage — deterministic correlation/grouping by signature+source, counts, noise suppression, priority scoring (no LLM). - narrate_findings — deterministic template narrative + summary for triaged groups (no LLM, no network). - list_capabilities — static capabilities: tools, guardrails, credential slots, triage knobs. - plan_inputs — interview helper returning questions, JSON schema, and a ready-to-edit example for a tool. Array/object arguments may be passed as JSON or a JSON string. Missing required inputs return a structured needs_input payload (questions + schema + example) instead of erroring, and upgrade to a native elicitation form on clients that support it.

Example prompts

• Run run_full on the mock alerts for last_24h with severity_min medium and summarize the critical groups.
• Here are my own alerts — normalize_alerts then correlate_and_triage this array and show the priority-scored groups.
• I have triaged groups already — use narrate_findings to write the analyst summary, no LLM, no network.
• Call list_capabilities: which credential slots, guardrails, and triage knobs does this agent expose?
• Use plan_inputs for correlate_and_triage and show me the questions, schema, and a ready-to-edit example.

Tools (7)

Tools the agent exposes — your AI client calls them automatically when it needs them.

• run_full — Run the full SIEM triage pipeline end-to-end: fetch alerts (read-only), normalize, correlate/triage deterministically, synthesize an analyst narrative (LLM with template fallback), return the full result JSON.
• fetch_alerts — Fetch raw alerts from the SIEM connector (READ-ONLY; mock/provided data offline). Returns the raw alert envelope without triage.
• normalize_alerts — Deterministically normalize raw alerts: map severity, mask PII sources, sanitize free text, apply severity_min filter. No LLM.
• correlate_and_triage — Deterministically correlate/group normalized alerts by signature+source, count, suppress noise/flapping, and priority-score. No LLM.
• narrate_findings — Produce the deterministic template narrative + summary for already-triaged groups (no LLM, no network; grounded only in provided data).
• list_capabilities — List the agent's static capabilities: tools, guardrails, credential slots, and triage knobs.
• plan_inputs — Plan/brainstorm the inputs for a tool: returns the questions, schema and a ready-to-edit example.