Building an Agentic SOC with Open-Source Tools

CrowdStrike. SentinelOne. Palo Alto Networks. Microsoft Sentinel.

The 2026 agentic SOC market is exploding. Gartner tracks 25+ vendors. CRN lists 10 "hot" platforms. Dropzone AI claims 60% MTTR reduction across 10,000+ daily alerts.

Impressive — if you've got a $500K annual security budget.

Most small and mid-size businesses don't. They have a sysadmin who doubles as the security team, a firewall they configured two years ago, and a vague hope that their cloud provider handles the rest.

Here's the thing: the core architecture behind every agentic SOC platform — automated alert triage, vulnerability scanning, remediation workflows, compliance auditing — can be built with open-source tools and AI agent orchestration. Today. For zero licensing cost.

This isn't theoretical. We built it. Here's how.

What Makes a SOC "Agentic"?

Traditional SOCs are reactive. An alert fires, a human investigates, a ticket gets opened, someone eventually fixes it. The median time from alert to remediation? According to IBM's 2025 Cost of a Data Breach Report: 277 days.

An agentic SOC inverts this model. AI agents:

1. Continuously monitor — parsing logs, scanning containers, checking configurations
2. Autonomously triage — classifying severity, deduplicating, correlating events
3. Execute remediation — patching vulnerabilities, hardening configurations, updating rules
4. Report and audit — generating structured logs for compliance review

The key difference isn't the tools — it's the orchestration. Individual security tools have existed for decades. What's new is having an AI orchestrator that coordinates them into a coherent, autonomous pipeline.

The Architecture: Wrapper-Based Security Orchestration

Enterprise agentic SOC platforms typically use heavyweight MCP (Model Context Protocol) integrations — passing 18,000+ tokens per tool call to maintain context. That's expensive, slow, and fragile.

Our approach uses a wrapper architecture: lightweight shell and Python scripts that wrap open-source security tools, producing standardized JSON output that an AI orchestrator can consume with 95-99% fewer tokens.

The wrapper layer is the critical innovation. Each wrapper:

• Accepts simple CLI arguments (no complex configuration files)
• Produces structured JSON output (parseable by any LLM)
• Includes severity classification (so the orchestrator knows what's urgent)
• Logs execution metadata (for audit trails)

Let's walk through the key components.

Component 1: Network Threat Detection with Suricata

Suricata is the open-source IDS/IPS that powers network monitoring for organizations ranging from startups to Fortune 500s. Our wrapper turns its EVE JSON logs into actionable intelligence:

#!/usr/bin/env python3
"""
Suricata IDS Alerts Wrapper
Parses Suricata's EVE JSON log for security alerts
Usage: ./suricata-alerts.py [--since MINUTES] [--severity high|medium|low]
"""

def get_severity_priority(priority):
    """Map Suricata priority to severity level"""
    if priority == 1:
        return "high"
    elif priority == 2:
        return "medium"
    else:
        return "low"

def parse_eve_log(log_file, since_minutes, severity_filter, limit):
    """Parse Suricata EVE JSON log for alerts"""
    cutoff_time = datetime.now() - timedelta(minutes=since_minutes)
    alerts = []
    # Parse each line, filter by time and severity,
    # return structured JSON with source/dest IPs,
    # signature IDs, and threat classifications

The output is compact JSON — source IP, destination IP, signature, severity, timestamp. An AI agent can process this in under 500 tokens, compared to 18,000+ if it had to parse raw EVE logs through an MCP integration.

What this enables: Your AI agent can run suricata-alerts.py --since 15 --severity high every 15 minutes and immediately know about network threats without human intervention.

Component 2: Container Vulnerability Scanning with Trivy

If you're running Docker containers (and in 2026, who isn't?), unpatched container images are your largest attack surface. Trivy scans images against vulnerability databases, and our wrapper standardizes the output:

#!/bin/bash
# Trivy Container Image Scanner Wrapper
# Usage: ./trivy-scan-image.sh <image-name> [--severity CRITICAL,HIGH]

IMAGE_NAME="${1:-}"
SEVERITY_FILTER="${2:-UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL}"

# Sanitize image name for filename
SAFE_IMAGE_NAME=$(echo "$IMAGE_NAME" | sed 's/[\/:]/-/g')
OUTPUT_FILE="$PROJECT_ROOT/data/state/scans/trivy-image-$SAFE_IMAGE_NAME-$TIMESTAMP.json"

# Run Trivy with JSON output, filtered by severity
trivy image --format json --severity "$SEVERITY_FILTER" "$IMAGE_NAME" > "$OUTPUT_FILE"

Feed this into your AI orchestrator, and it can scan every container image on a schedule, flag critical CVEs requiring immediate patching, compare results over time, and generate vulnerability posture reports.

Component 3: Automated Remediation

Here's where agentic security gets powerful. Most SOCs stop at detection. An agentic SOC also fixes things.

Our auto-remediation script prioritizes by severity and applies automated fixes:

#!/bin/bash
# Automated Vulnerability Remediation Script
# Prioritizes: P0 (Critical) > P1 (High) > P2 (Medium) > P3 (Low)

remediate() {
    local severity="$1"
    local cve_id="$2"
    local package="$3"
    local fix_type="$4"

    case "$fix_type" in
        "apt-upgrade")
            sudo DEBIAN_FRONTEND=noninteractive \
                apt-get install --only-upgrade -y "$package"
            ;;
        "config-fix")
            apply_hardening_config "$package"
            ;;
        "service-restart")
            systemctl restart "$package"
            ;;
        "manual-review")
            log_warning "Requires manual review: $cve_id"
            ;;
    esac
}

The critical guardrail: Not everything gets auto-remediated. The script classifies fixes into four types:

The manual-review category is non-negotiable. AI agents should never auto-apply changes that could break production systems. Human oversight isn't a weakness — it's a design principle.

Component 4: CIS Compliance Automation

The CIS (Center for Internet Security) benchmarks are the gold standard for system hardening. Our CIS Level 1 playbook automates 50+ hardening checks and remediations for Ubuntu systems:

# From cis-ubuntu-level1.sh — automated compliance
# Ensure permissions on /etc/passwd are configured
check_file_permissions "/etc/passwd" "644" "CIS 6.1.2"

# Ensure SSH root login is disabled
ensure_config "/etc/ssh/sshd_config" "PermitRootLogin" "no" "CIS 5.2.10"

# Ensure audit log storage size is configured
ensure_config "/etc/audit/auditd.conf" "max_log_file" "8" "CIS 4.1.2.1"

# Ensure firewall is active
check_service_active "ufw" "CIS 3.5.1.1"

Each check produces a pass/fail/remediated result. The AI orchestrator aggregates these into a compliance score — "Your system is 87% CIS Level 1 compliant, with 6 items requiring manual review."

That's the kind of number that makes CISOs happy and auditors satisfied.

The Token Economics

Why does this matter? Because the biggest cost in running an agentic SOC isn't the security tools — it's the AI inference cost.

For an SMB running this 24/7, that's the difference between $1,971/year and $54.75/year in AI inference costs. Add that the underlying security tools are all open-source (zero licensing), and you've got a production-grade SOC for under $100/year in compute costs.

Getting Started: Your Open-Source Agentic SOC in 48 Hours

Hours 1-4: Install the Foundation

# Core security tools
sudo apt install suricata clamav aide chkrootkit lynis

# Container scanning
curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sh

# OSV Scanner (dependency vulnerabilities)
go install github.com/google/osv-scanner/cmd/osv-scanner@latest

Hours 5-12: Deploy Wrappers

Clone the wrapper scripts. Configure paths for your environment. Run each wrapper manually to verify output format.

Hours 13-24: Configure Orchestration

Set up your AI agent to call wrappers on a schedule. Define escalation rules: what gets auto-remediated, what gets flagged.

Hours 25-48: Test and Harden

Run the full scan cycle. Review outputs. Tune Suricata rules for your network. Adjust CIS playbook for your specific requirements. Verify auto-remediation works on non-critical systems first.

Day 3+: You have a working agentic SOC.

What Enterprise Platforms Still Do Better

Let's be honest about trade-offs. Enterprise agentic SOC platforms from CrowdStrike, Microsoft, and Palo Alto offer:

• Pre-built threat intelligence feeds (our approach uses public CVE databases)
• Cross-customer threat correlation (we operate in isolation)
• Managed detection and response (MDR) (we're self-operated)
• Regulatory compliance certifications (SOC 2, ISO 27001 for the platform itself)
• 24/7 human analyst backup (we rely on our AI agent + human escalation)

If you're a Fortune 500 processing regulated financial data, buy the enterprise platform. If you're an SMB that currently has no automated security operations, the open-source approach gets you 80% of the value for 0.01% of the cost.

The best security is the security you actually deploy.

The Bottom Line

Google's 2026 Business Trends Report predicts that AI agents will "take over the most taxing security operations work" this year. PwC's AI predictions emphasize that agents can "automatically document their decisions and actions" for continuous monitoring.

They're talking about enterprise platforms with enterprise price tags. But the underlying pattern — automated detection, AI-powered triage, orchestrated remediation — is reproducible with open-source tools.

Every business deserves security operations that don't sleep. You don't need a $500K budget to build them. You need the right architecture, the right tools, and an AI agent smart enough to tie them together.

Your SOC doesn't need to be expensive. It needs to be agentic.

Ready to build your agentic SOC? OptinAmpOut designs and deploys AI-powered security operations for businesses that need enterprise-grade protection without enterprise-grade budgets. Let's talk about your security posture →