ThinkingSoc

The description states that ThinkingSOC is a system that receives Splunk alerts and routes them through security analysis workflows using specialized AI agents. These agents collaborate to collect context, inspect inventory and threat information, propose findings, and produce structured results reviewed by a "Judge stage". When an analyst acknowledges an investigation, ThinkingSOC converts it into a reusable runbook.

The system uses:

• A backend built with FastAPI, Python, and Pydantic
• PostgreSQL for storing analysis results, runbooks, approvals, replays, agent traces, and chat history
• Qdrant for runbook-aware retrieval in chat
• Neo4j for relationship and correlation views
• An analyst interface built with Next.js, React, and a dark visual system

It also includes:

• A webhook-based alert ingestion mechanism
• Splunk integration via MCP (when available) or authenticated REST API as fallback
• Read-only SPL validation and execution pipeline
• LLM access through LiteLLM for configurable provider selection
• Five specialized agents: Supervisor, Evidence Scout, Runbook Engineer, Policy Guard, Response Advisor

The system is described as not allowing AI-generated content to set its own verification or approval status. All executable investigation queries are fresh, read-only, and parser-validated.

Evidence Self-reported by author; no independent verification provided.

The description states that ThinkingSOC was built to address a problem where security analysts spend excessive time repeating similar investigations due to lack of knowledge sharing across tickets or individuals. The goal is not unrestricted automation but rather a practical system combining AI agents with deterministic validation, live Splunk evidence, and human approval.

It positions itself as:

• A tool that makes every accepted investigation improve the next one
• An operational workflow rather than a standalone demo
• Focused on reducing repetitive work while keeping analysts in control of important decisions

The project emphasizes:

• Separation of reusable intent from executable SPL
• Visibility into agent collaboration and tool use
• Auditable records of approvals, edits, replays, and targets
• Safe reuse of runbooks under strict conditions (same alert name, different identifier)
• Non-executable "Safe Response Previews"

Evidence Self-reported; no external validation or market positioning data.

The description indicates that ThinkingSOC is aimed at Security Operations Centers (SOCs) dealing with Splunk alerts. It targets analysts who are overwhelmed by repetitive investigations and need tools to improve efficiency while maintaining human oversight.

It mentions:

• A six-analyst SOC scenario as an illustrative example
• Potential savings of 2,600 analyst hours per year in such a scenario
• Value model separating measured evidence from assumptions

Evidence Self-reported; no explicit customer list or segmentation data provided.

The description does not contain any information about pricing models, monetization strategies, or business models. It focuses entirely on the technical architecture and workflow of the system.

Evidence Not evidenced.

The project is built using:

• Backend: FastAPI, Python, Pydantic
• Database: PostgreSQL
• Vector DB: Qdrant
• Graph DB: Neo4j
• Frontend: Next.js, React
• LLM integration: LiteLLM
• Splunk integration: MCP (preferred), REST API fallback

It includes:

• Installation workflow and demo PostgreSQL bundle
• JSON fallback mechanism
• Live health checks
• Runbook logging
• Automatic SPL refinement
• Typed SDK methods
• Frontend and backend tests
• Production smoke tests
• Demo data showing same-name/different-alert runbook journey

Agents operate within a bounded workflow with defined tools, and their actions are recorded in append-only traces.

Evidence Self-reported; no independent technical review or delivery metrics.

The description does not provide any evidence of traction or maturity beyond the hackathon submission. It mentions:

• A demo environment with complete judge-ready data
• End-to-end smoke tests
• Test tooling that avoids duplicate webhook identifiers
• No revenue, customer base, or adoption metrics are mentioned

Evidence Not evidenced.

The description does not mention any competitors or competitive landscape. It focuses solely on the internal architecture and workflow of ThinkingSOC without referencing existing solutions in the security automation space.

Evidence Not evidenced.

Key risks and red flags based on the self-reported information:

• The system is presented as a hackathon submission with no evidence of real-world deployment or usage
• No mention of scalability, performance, or reliability in production environments
• Lack of pricing, monetization strategy, or business model details raises questions about commercial viability
• No evidence of customer feedback, user testing, or market validation beyond internal claims
• The focus on human approval and deterministic workflows may limit its appeal to organizations seeking more autonomous automation

Inference Given the lack of any traction data or real-world deployment, there is a high risk that this remains an unproven concept.

1. Has ThinkingSOC been tested in a live SOC environment?
2. What specific Splunk integrations are supported beyond MCP and REST API?
3. How does the system handle edge cases where Splunk is unavailable or returns inconsistent data?
4. Are there any plans for monetization, pricing models, or go-to-market strategy?
5. What metrics are used to evaluate the accuracy and usefulness of generated runbooks?
6. How is the system designed to scale with increasing numbers of alerts and users?
7. What kind of training or support is provided to analysts using the platform?