SIEM Alert Narrator

What it does

SIEM Alert Narrator is a read-only SOC/SecOps triage agent. It pulls security alerts from a SIEM (Datadog or a generic read API) READ-ONLY, runs a deterministic triage core — normalize, map severity, correlate and group by signature + source, suppress noise/flapping, and priority-score — then uses an LLM ONLY to synthesize an analyst-friendly narrative (what happened / why it matters / suggested next step). Every count, severity, and source is code-derived; the model never invents numbers and never asserts a definitive cause. Without an API key (and no host sampling) it degrades gracefully to a deterministic template. Read-only by construction (GET-only; no mute/close/action endpoints). Gated: live SIEM access needs credentials (Datadog API + app key, or a generic SIEM bearer token); with none provided it runs entirely on mock alert fixtures or your own caller-provided alerts — so you can try it offline with zero setup. Guardrails: read-only, egress allowlisted to the SIEM host, PII/source masking, API-key non-leak, prompt-injection defang on all alert text, no fabrication (no alerts ⇒ empty triage), and advisory-only recommendations. Tools: - run_full — end-to-end: fetch (read-only), normalize, correlate/triage, narrate, return the full result JSON. - fetch_alerts — fetch raw alerts from the connector (read-only; mock/provided offline), no triage. - normalize_alerts — deterministic normalization: severity mapping, PII masking, text sanitization, severity_min filter (no LLM). - correlate_and_triage — deterministic correlation/grouping by signature+source, counts, noise suppression, priority scoring (no LLM). - narrate_findings — deterministic template narrative + summary for triaged groups (no LLM, no network). - list_capabilities — static capabilities: tools, guardrails, credential slots, triage knobs. - plan_inputs — interview helper returning questions, JSON schema, and a ready-to-edit example for a tool. Array/object arguments may be passed as JSON or a JSON string. Missing required inputs return a structured needs_input payload (questions + schema + example) instead of erroring, and upgrade to a native elicitation form on clients that support it.

Example prompts

• Run run_full on the mock alerts for last_24h with severity_min medium and summarize the critical groups.
• Here are my own alerts — normalize_alerts then correlate_and_triage this array and show the priority-scored groups.
• I have triaged groups already — use narrate_findings to write the analyst summary, no LLM, no network.