AI SOC Agent MCP Server

python agent.py



\## MCP Integration



This project includes an MCP server exposing SOC analysis tools:



\- `soc\_map\_attack`

\- `soc\_calculate\_severity`

\- `soc\_map\_mitre`

\- `soc\_recommend\_actions`



The MCP client successfully calls the server and returns:



```text

Attack: Brute Force

Severity: High

MITRE: T1110 - Brute Force

Actions: Block source IP



\## Current MCP Test Output



The MCP client successfully analyzes multiple security incidents:



\- Brute Force

\- SQL Injection

\- XSS

\- API Abuse

\- Session Hijacking



Each incident returns:



\- Attack type

\- Severity

\- MITRE ATT\&CK technique

\- Recommended remediation actions



\## Interactive AI SOC Assistant



Run:



```bash

python ai\_soc\_assistant.py



Which incidents should I escalate?

Show MITRE mapping

Give me remediation actions

Give me summary



The assistant reads mcp\_incident\_reports.json and answers SOC analyst questions.





Then commit:



```powershell

git add .

git commit -m "Add interactive SOC assistant documentation"