← ProjectsUpcoming

AI SOC

A planned lab environment where a real attacker VM generates genuine malicious traffic against a target machine, Wazuh raises the alerts as it normally would, and Claude — fed structured alert context through an MCP server — triages true vs false positive, explains the reasoning, classifies severity, and recommends escalation, closing the loop back into Wazuh.

Overview

The next chapter of AMVAT Labs — an AI-augmented layer my teammate and I have mapped out on top of our existing Wazuh-based SOC.

The idea: instead of testing the AI layer against synthetic or replayed alerts, drive it with a genuine attacker VM (Kali Linux) running real brute-force, web attacks, and malware against a target machine (Debian) in an isolated lab network. Wazuh sees exactly what it would see in a real environment — nothing pre-cooked — and the AI has to triage real alerts, not a curated demo set.

Planned architecture

  1. Attacker → target — a Kali Linux VM runs brute-force, web attack, and malware traffic against a Debian target in an isolated victim network.
  2. Log generation — the target’s auth, syslog, and event logs are picked up by a Wazuh agent.
  3. Telemetry streaming — the agent streams that telemetry to the Wazuh Manager.
  4. Alert generation — the Manager raises alerts as usual, visible on the normal Wazuh SIEM dashboard.
  5. Trigger alert export — alerts are also handed to a Wazuh MCP (Model Context Protocol) server sitting alongside the Manager.
  6. Structured JSON context — the MCP server exports each alert as structured context to Claude, acting as the AI SOC analyst.
  7. Analyst decision logic — Claude works the alert the way a tier-1 analyst would: true vs false positive, a contextual explanation of why, a severity classification, and an escalation call — then sends the result (and can query back for more context) through the MCP server.
  8. Action / enriched data — that enriched verdict flows back into the Wazuh Manager, closing the loop.

Why this

Alert triage — sorting true positives from noise, explaining the reasoning, deciding what actually needs escalating — is the daily reality of SOC work and the first place an AI layer can genuinely help rather than just add another dashboard. Building it against a real attacker/target pair instead of mocked data is the point: if it can’t hold up against genuine, messy telemetry, it isn’t worth trusting against the real thing either.