Securityclaw Autonomous Soc Agent

This is a complete autonomous SOC framework that combines RAG-based threat detection with LLM analysis over OpenSearch or Elasticsearch data. It runs scheduled skills like network baselining every 6 hours and can poll for anomalies every minute, then uses retrieval-augmented context to validate threats through a LangGraph orchestration loop. The skill-based architecture means you can write new detections as isolated Python modules with LLM instruction files. Ships with both a React web UI and CLI for investigations, plus an onboarding wizard that configures your database connections and LLM provider. If you're already running Ollama locally and have security logs in OpenSearch, you can have an AI analyst watching your environment in about 10 minutes. The code is genuinely modular and lets you swap providers without refactoring core logic.

skills.sh installs: 659
GitHub stars: 6
last updated: Jul 14, 2026

View on GitHub

Install

$ npx -y skills add aradotso/security-skills --skill securityclaw-autonomous-soc-agent --agent claude-code

Installs into .claude/skills of the current project.

Files

SecurityClaw Autonomous SOC Agent

Skill by ara.so — Security Skills collection.

SecurityClaw is a modular, skill-based autonomous Security Operations Center (SOC) agent that monitors OpenSearch/Elasticsearch data, builds RAG-based behavioral memory, and validates real-time anomalies using LLMs. It orchestrates security workflows through LangGraph, maintains conversation-based investigations, and provides both CLI and web interfaces for threat analysis.

Core Capabilities

Skill-based architecture: Each capability is an isolated module with Python logic + LLM instruction
RAG behavioral memory: Vector embeddings of network baselines stored in OpenSearch
Anomaly detection: Scheduled 1-minute watcher polls findings and escalates threats
LLM-powered analysis: Threat analyst validates anomalies using retrieval-augmented context
LangGraph orchestration: DECIDE→EXECUTE→EVALUATE supervisor loop with SQLite checkpointing
Web + CLI interfaces: React UI for chat investigations, CLI for automation
Provider agnostic: Swap OpenSearch↔Elasticsearch, Ollama↔other LLM providers