#incident-response

The self-improving SRE agent

VERDICT — a DFIR agent (Claude Code as the engine) that produces a signed, offline-verifiable verdict. SANS Find Evil! 2026.

Turn Claude Code into a team that has to prove it. 44 skills, 8 review agents, a validation router and a knowledge layer where nothing is claimed without a check that could have failed.

AI IR Overlay™ — practical incident response framework for AI agents in production. Built on NIST SP 800-61 r3, mapped to NIST AI RMF, NIST CSF 2.0, OWASP Top 10 for Agentic Applications 2026, ISO/IEC 42001, EU AI Act.

An autonomous, LLM-powered SRE agent that takes production incidents from alert to fix/pulls metrics and logs, diagnoses the root cause, runs remediation, and writes the incident report.

The Solana emergency copilot — evidence-first, read-only incident triage for failed transactions, drains, compromised authorities, RPC issues & frontend compromise. Never moves funds. MIT.

Local-first incident triage agent with typed tools, weighted evidence, and structured root-cause reports.

Read-only first-pass incident triage on the Claude Agent SDK + MCP: classifies an alert, retrieves the matching runbook, and proposes a cited first response — or abstains to a human. Measured over four runs: 100% abstention with 0 missed escalations, ~$0.014 per incident.

LLM alert triage over a live Wazuh SIEM, scored against a labelled corpus and a threshold baseline

The on-call data team that gets smarter every night. Claude agents on DataHub: incidents resolved, postmortems remembered in the graph itself.

An agent-native database. Sessions are branches an agent can fork, merge, and rewind; every write records what it was derived from; and taint-and-recall tells you exactly what a poisoned input contaminated. Built on substrate.

Production-grade AI incident response system built on n8n. 3 workflows, human approval gate, dual-model fallback, and 23-column governance audit trail.

Browser-playable DFIR CTF labs organised by MITRE ATT&CK Enterprise tactics. Self-contained HTML, no agent required at runtime.

A Kubernetes lab that reproduces real production incidents on a live, instrumented microservice stack — for testing root-cause-analysis tools and agents.

W.A.R.V.I.S. — Forensic IR agent (Go orchestrator + Python MCP + Gemma 4). SANS FIND EVIL hackathon entry by WoopsFactory.