v0.5.2 - When all is darkest

Release notes

Full release notes: https://asp.viperrtp.com/release/0_5_2_When_all_is_darkest/

Downloads

• asp-compose-0.5.2.tar.gz

Container images

• ghcr.io/funnywolf/agentic-soc-platform/asp-backend:0.5.2
• ghcr.io/funnywolf/agentic-soc-platform/asp-frontend:0.5.2

v0.5.1

Release notes

Full release notes: https://asp.viperrtp.com/release/0_5_1_Growing_Strong/

Downloads

• asp-compose-0.5.1.tar.gz

Container images

• ghcr.io/funnywolf/agentic-soc-platform/asp-backend:0.5.1
• ghcr.io/funnywolf/agentic-soc-platform/asp-frontend:0.5.1

v0.5.0

Release notes

Full release notes: https://asp.viperrtp.com/release/0_5_0_Fire_and_Blood/

Downloads

• asp-compose-0.5.0.tar.gz

Container images

• ghcr.io/funnywolf/agentic-soc-platform/asp-backend:0.5.0
• ghcr.io/funnywolf/agentic-soc-platform/asp-frontend:0.5.0

v0.4.1

Release notes

Full release notes: https://asp.viperrtp.com/release/0_4_1_deployment_patch/

Downloads

• asp-compose-0.4.1.tar.gz

Container images

• ghcr.io/funnywolf/agentic-soc-platform/asp-backend:0.4.1
• ghcr.io/funnywolf/agentic-soc-platform/asp-frontend:0.4.1

v0.4.0

Release notes

Full release notes: https://asp.viperrtp.com/release/0_4_0_I_always_have_a_choice/

Downloads

• asp-compose-0.4.0.tar.gz

Container images

• ghcr.io/funnywolf/agentic-soc-platform/asp-backend:0.4.0
• ghcr.io/funnywolf/agentic-soc-platform/asp-frontend:0.4.0

0.3.0

新功能

• SIEM Plugin 支持Splunk / ELK, 可添加自定义日志配置信息, 添加适用于 LLM 的, 统一的日志检索接口.
• MCP Plugin 正式版本,支持 ASP 大部分核心功能
• Claude Code Plugin , 内置 MCP 连接, 8个 Skill, 1个 agent

优化

• SIRP 优化 UI 布局和字段的权限控制
• 删除 Dify / Mem0 插件, 删除 Neo4j / Chroma 支持

开发者笔记

SIEM 是 SOC 中的核心平台,承载着所有的日志数据, 无论人员还是 LLM 都需要接口从 SIEM 搜索日志来进行信息富化或者调查.

Splunk 是商业化 SIEM 的领导者, ELK 是开源届 SIEM 最优解决方案, 所以 ASP 首先选择支持这两个平台. ASP 将日志接口统一化, 外部调用无需关心具体的 SIEM 实现方案.

SIEM 平台当前不支持在平台中添加对日志的说明 (例如某个 index 的具体用途, index 中某个字段的说明), 传统方式是使用外部的 wiki 存储这类信息, 安全人员通过查看文档来确认日志用途, 但这种方案不利于集成和 LLM 的调用和分析. ASP 使用 yaml 文件存储这类数据, 并统一成一个外部接口, 方便 LLM 调用 (也可以作为 Claude Code Plugin 中的 Reference 文件, 但这种实现代码中无法调用).

在当前环境下,用户使用自然语言与平台或者软件对话来进行操作是刚性需求. 当前有两种方案:

• 平台自身实现 UI 层的对话接口和 Harness Engineering
• 与外部的 Harness Engineering 集成

无论系统成熟度,用户接受程度,工作量等多个角度来说, 第二个方案是最优选择.

ASP 需要提供接口可以让 LLM 进行操作,有两种选择:

• 使用 MCP Server, 将各个功能封装成 API (Tools),供外部工具调用
• 实现一个 cli,通过命令行参数实现渐进式的功能暴露

ASP 选择第一个方案,先说优点:

• 有成熟的框架 (fastmcp)
• 函数使用 pydantic 和 typing 就可以将入参说明,函数,返回值说明等直接暴露,无需额外操作
• 主流工具都支持直接对接

再说缺点:

• MCP 当前还不支持渐进式加载,会固定的占用上下文

cli 工具的优点是可以 --help 来实现渐进式加载, 缺点是 LLM 在使用时会增加一部分 Tools 调用请求,且因为没有成熟的工程化方案,实现工作量很大.

考虑到 ASP 的目标用户都是专业的网络安全技术人员, 对命令行的接受度较高, 所以 Claude Code 就成为了 Harness Engineering 工具的首选.

MCP Server 确保提供的 Tools 功能原子化,尽量的压缩说明内容,确保占用最小的上下文. 将详细的使用方法和经典的 SOP 拆分成不同的 Skill,也方便优化和自定义. 如果需要更加复杂的,长时间的,独立上下文的工作流,可以使用 Agent, ASP 提供了一个 Case 调查的 Agent 作为参考和初始版本.

在 ASP 可以与 Claude Code 等外部工具对接后, Dify 等带 UI 的工作流就没有必要了,所有的和用户交互,记忆管理,多 Agent 都交由 Claude Code 实现.

Mem0 的优点是简单的接口,原生的 GraphRAG 支持,缺点是依赖外部图数据库 (neo4j),构建 GraphRAG 时需要 调用 LLM 进行额外分析,性能不佳.

Mem0 主要场景是个人助理和长期记忆, 而 ASP 使用 RAG 是作为知识库使用,为 Secops 提供参考信息,通常也不会很大. 实际工作中使用关键字和语义混合搜索 (通过稀疏向量和稠密向量实现) 就可以达到性能要求.通过加大返回结果数和使用 rerank 模型,准确度也有保证.

Neo4j 用于 Mem0, 在不使用 Mem0 后也是不必要的. Qdrant 插件已经集成到 ASP ,同时支持稀疏向量和稠密向量存储, 所以 Chroma 也不必要了.

New Features

• SIEM Plugin supports Splunk / ELK, allows custom log configuration metadata, and adds a unified log retrieval interface for LLMs.
• MCP Plugin reaches its official release and supports most core ASP capabilities.
• Claude Code Plugin includes built-in MCP connectivity, 8 skills, and 1 agent.

Improvements

• SIRP UI layout and field-level permission control have been improved.
• Removed the Dify / Mem0 plugins and dropped Neo4j / Chroma support.

Developer Notes

SIEM is the core platform in a SOC and carries all log data. Both humans and LLMs need an interface to search logs in SIEM for enrichment or investigation.

Splunk is the leader in commercial SIEM, and ELK is the best-known open-source SIEM solution, so ASP first chose to support these two platforms. ASP standardizes the log interface so external callers do not need to care about the underlying SIEM implementation.

Current SIEM platforms do not support adding log descriptions directly in the platform itself, such as the purpose of a specific index or the meaning of fields within an index. The traditional approach is to store this information in an external wiki, where security personnel check the documentation to understand log usage, but that approach is not friendly to integration or to LLM-based retrieval and analysis. ASP stores this data in YAML files and exposes it through a unified external interface, which makes it easier for LLMs to consume. It can also serve as reference files in the Claude Code Plugin, although that approach cannot be called from code.

In the current environment, it is a hard requirement for users to operate platforms or software through natural-language conversation. There are currently two approaches:

• Implement a conversation interface and harness engineering directly in the platform UI.
• Integrate with external harness engineering.

From the perspectives of system maturity, user acceptance, and implementation effort, the second approach is the best choice.

ASP needs to expose interfaces that allow LLMs to operate it. There are two options:

• Use an MCP Server and wrap each feature as an API tool for external invocation.
• Implement a CLI and expose functionality progressively through command-line arguments.

ASP chose the first option. Its advantages are:

• It has a mature framework (fastmcp).
• With pydantic and typing, function signatures, parameter descriptions, and return-value descriptions can be exposed directly without extra work.
• Mainstream tools support direct integration.

Its drawback is:

• MCP does not yet support progressive loading, so it consumes context in a fixed way.

The advantage of a CLI is that --help can provide progressive loading. The downside is that LLM usage adds extra tool-call requests, and because there is no mature engineering pattern for this, the implementation effort is large.

Given that ASP's target users are professional cybersecurity practitioners and are generally comfortable with the command line, Claude Code becomes the preferred harness engineering tool.

The MCP Server ensures that the provided tools are atomic and that their descriptions are compressed as much as possible to minimize context usage. Detailed usage instructions and standard SOPs are split into separate skills, which also makes them easier to optimize and customize. If you need a more complex, long-running workflow with independent context, you can use an agent. ASP provides a case investigation agent as a reference and initial version.

Once ASP can integrate with external tools such as Claude Code, UI-based workflows like Dify are no longer necessary. All user interaction, memory management, and multi-agent orchestration are handled by Claude Code.

Mem0's strengths are its simple interface and native GraphRAG support. Its weaknesses are that it depends on an external graph database (Neo4j), requires extra LLM analysis when building GraphRAG, and performs poorly.

Mem0 is mainly designed for personal assistants and long-term memory, while ASP uses RAG as a knowledge base to provide reference information for SecOps and is usually not large. In practice, keyword and semantic hybrid search, implemented through sparse and dense vectors, is enough to meet performance requirements. Accuracy can also be ensured by increasing the number of returned results and using a rerank model.

Neo4j is used by Mem0, and once Mem0 is no longer used, it is unnecessary as well. The Qdrant plugin is already integrated into ASP and supports both sparse and dense vector storage, so Chroma is no longer needed either.

v0.2.0 - OCSF 和 BaseModel / OCSF and BaseModel

新功能亮点

• Case 基于 OCSF Incident Finding 标准进行重构, 提供统一的事件调查和响应数据结构.
• Alert 基于 OCSF Detection Finding 标准进行重构, 提供统一的告警数据结构.
• 新增 Enrichment 和 Ticket 模块, 分别用于存储丰富化数据和外部工单数据.

优化

• 重构 SIRP 的插件代码,使用 BaseModel 并更新 API, 提升代码一致性和可维护性.

开发者笔记

新版本 SIRP 平台的 Case 和 Alert 模块均基于 OCSF 标准进行重构, 好处有以下几点:

1. 统一的数据结构: OCSF 提供了一个统一的框架, 使得不同安全工具和平台之间的数据交换变得更加容易.
2. 字段丰富: OCSF 标准定义了丰富的字段, 覆盖了大部分安全事件和告警的关键信息, 有助于提升数据的完整性.用户基本上不需要再自定义字段.
3. 生态系统支持: 采用 OCSF 标准使得 SIRP 更容易与其他支持 OCSF 的工具和平台集成, 扩展了 SIRP 的应用场景.

ASP 的插件代码重构为 BaseModel, 主要目的是提升代码的一致性和可维护性. 拥有更好的 IDE 提示和类型检查, 减少运行时错误.

Feature Highlights

• Case has been restructured based on the OCSF Incident Finding standard, providing a unified
  data structure for event investigation and response.
• Alert has been restructured based on the OCSF Detection Finding standard, providing a
  unified alert data structure.
• New Enrichment and Ticket modules added for storing enrichment data and external ticket data respectively.

Optimization

• Refactored SIRP plugin code to use BaseModel and updated API, improving code consistency and maintainability.

Developer Notes

The Case and Alert modules of the new version SIRP platform have been restructured based on the OCSF standard. The benefits are as follows:

1. Unified Data Structure: OCSF provides a unified framework that makes data exchange between different security tools and platforms easier.
2. Rich Fields: The OCSF standard defines rich fields that cover key information for most security events and alerts, helping to improve data completeness. Users basically no
   longer need to customize fields.
3. Ecosystem Support: Adopting the OCSF standard makes SIRP easier to integrate with other tools and platforms that support OCSF, expanding SIRP's application scenarios.

The ASF plugin code has been refactored to use BaseModel, with the main goal of improving code consistency and maintainability. It provides better IDE hints and type checking,
reducing runtime errors.

Chaos Before Order 秩序之前的混乱

New Feature Highlights

• Message stores all message records during Agent runtime, including system messages, human messages, AI messages, and tool messages, facilitating auditing and debugging.
• Agents provides a basic agent framework, supporting four out-of-the-box agents: CMDB, SIEM, ThreatIntelligence, and Knowledge.
• Qdrant is a Qdrant vector database plugin, supporting vector data storage and retrieval.
• Neo4j is a Neo4j graph database plugin, used to support knowledge graph storage for the Mem0 plugin.
• Mem0 is a Mem0 plugin, supporting Mem0 for managing knowledge bases and providing graph database support for knowledge bases and agents (Beta).
• Embeddings is an Embeddings plugin, supporting OpenAI and Ollama's Embedding models, and two vector databases: Chroma and Qdrant.
• Knowledge knowledge base and Knowledge agent, supporting knowledge base management and agent's knowledge base calls.
• Case_L3_SOC_Analyst_Agent_With_Tools is the SOC L3 Analyst Agent (Tool Calling) playbook, which calls the Knowledge Base for L3 analysis.
• Updated SIRP to Nocoly 7.0.0.

Optimizations

• Optimized Playbook template code.
• Updated Playbook Case_Threat_Hunting_Agent prompts.
• Optimized SIRP and ASP interaction logic; SIRP no longer actively calls the ASP API, instead, ASP retrieves SIRP data through polling.
• Added Nginx configuration for Ollama's Basic Auth.
• Optimized Case_L3_SOC_Analyst_Agent_With_Tools and Case_Threat_Hunting_Agent tool calls to prevent infinite loops due to tool errors.
• Optimized Redis/SIRP network connection performance to improve stability during large-scale deployments.

Developer Notes

This update primarily revolves around the Knowledge feature and related plugins and agents that support the knowledge base.

The knowledge base is a critical component of SOC automated analysis and response, enabling agents to perform more accurate analysis and decision-making based on organization-specific knowledge.

By introducing the Mem0 and Qdrant plugins and the Knowledge agent, we provide users with a powerful tool to manage and utilize their knowledge assets.

The next version will focus on data standardization, redesigning the current SIRP Case/Alert/Artifact data structure.

新功能亮点

• Message 存储 Agent 运行时的所有消息记录, 包括系统消息, 人类消息, AI 消息和工具消息, 方便审计和调试.
• Agents 基础智能体框架,支持 CMDB,SIEM,ThreatIntelligence,Knowledge四个开箱即用智能体.
• Qdrant Qdrant 向量数据库插件, 支持向量数据存储与检索.
• Neo4j Neo4j 图数据库插件, 用于支持 Mem0 插件的知识图谱存储.
• Mem0 Mem0 插件, 支持 Mem0 管理知识库, 为知识库和智能体提供图数据库支持 (Beta).
• Embeddings Embeddings 插件, 支持 OpenAI 和 Ollama 的 Embedding 模型, 支持Chroma 和 Qdrant 两种向量数据库.
• Knowledge 知识库 和 Knowledge 智能体, 支持知识库管理及 Agent 的知识库调用.
• Case_L3_SOC_Analyst_Agent_With_Tools SOC L3 分析师智能体 (工具调用) 剧本,调用 知识库 进行 L3 分析.
• 更新 SIRP 到 Nocoly 7.0.0 版本.

优化

• 优化 Playbook 模板代码
• 更新 Playbook Case_Threat_Hunting_Agent 提示词
• 优化 SIRP 于 ASP 交互逻辑, SIRP 不再主动调用 ASP API, 由 ASP 通过轮询方式获取 SIRP 数据.
• 添加 ollama 的 Basic Auth 的 Nginx 配置
• 优化 Case_L3_SOC_Analyst_Agent_With_Tools 和 Case_Threat_Hunting_Agent 工具调用,防止因工具报错导致剧本无限循环.
• 优化 Redis/SIRP 网络连接性能,提升大规模部署时的稳定性.

开发者笔记

本次更新都是围绕 Knowledge 这个功能, 以及为知识库提供支持的相关插件和智能体.

知识库是 SOC 自动化分析和响应的关键组成部分, 它使得智能体能够基于组织特定的知识进行更准确的分析和决策.

通过引入 Mem0 Qdrant 插件和 Knowledge 智能体, 我们为用户提供了一个强大的工具, 以管理和利用他们的知识资产.

下一个版本主要专注于数据标准化,针对当前 SIRP 中 Case/Alert/Artifact 数据结构重新设计.

让我们嗨翻全场！Let`s Rock The Party !

欢迎来到 Agentic SOC Platform (ASP) 的第一个正式版本！ 经过两个月的密集开发，我们很高兴发布 v0.1.0。这个版本为 ASP 奠定了坚实的基础，融合了强大的 AI Agent 能力与灵活的自动化编排，旨在打造一个真正由
AI 驱动的、开源的安全运营平台。

✨ 新功能亮点

核心框架 (Core Framework)

• 🚀 告警流水线: 全新的告警转发与流式处理框架已准备就绪。现在您可以轻松集成 SIEM 的 Webhook，并模块化地构建 AI 告警分析与响应流水线。
• 🤖 剧本编排引擎: 初步的剧本引擎已上线，支持对 AI 智能体进行复杂的编排与执行，为自动化响应提供了无限可能。
• 🎯 内置威胁狩猎智能体: 我们在剧本中内置了强大的威胁狩猎智能体，能够适应并处理所有类型的威胁狩猎场景。

SIRP 平台

• 🛠️ 功能完备的 SIRP: 内置的 SIRP (Security Incident Response Platform) 平台基础功能已全面完成，提供了现代化的案件管理与响应界面。
• 🔗 自动化深度集成: 实现了基于 Playbook 的 UI 接口，将 ASP 强大的自动化编排（SOA）能力与 SIRP 的用户界面无缝结合。

💬 开发者笔记：初衷与愿景

最初，我只想开发一个纯粹的后端框架，用于模块化地处理来自 SIEM 的告警，而将用户交互界面交给像 TheHive 或 Splunk SOAR 这样的专业 SIRP 平台。

然而，在探索 AI 赋能 SOC 的过程中，我意识到“自动化”是不可或缺的一环，而 AI Agent 极大地增强了自动化的能力。真正的自动化需要与 UI 深度交互，因此，我们最终决定内置一个功能完备的 SIRP
平台，以提供无缝的体验。

如今，几乎所有国内外安全厂商都在拥抱 AI Agent，但其产品大多仅服务于自身的商业生态。通用的 SOAR 平台也往往只是简单地增加一些 LLM 功能节点。

ASP 的愿景是不同的：我们希望打造一个开源、可模块化定制的 AI 驱动安全运营平台。我们相信，每个组织都应该能够根据自身需求，灵活地构建真正属于自己的、智能化的安全运营体系。

0.1.0 只是一个开始，我们期待与社区一同成长，探索 AI 安全的更多可能。

Welcome to the first official version of the Agentic SOC Platform (ASP)! After two months of intensive development, we are excited to release v0.1.0. This version lays a solid
foundation for ASP, combining powerful AI Agent capabilities with flexible automation orchestration, aiming to create a truly AI-driven, open-source security operations platform.

✨ New Feature Highlights

Core Framework

• 🚀 Alert Pipeline: The new alert forwarding and stream processing framework is ready. You can now easily integrate SIEM webhooks and modularly build AI alert analysis and
  response pipelines.
• 🤖 Playbook Orchestration Engine: The initial playbook engine is online, supporting complex orchestration and execution of AI Agents, opening up infinite possibilities for
  automated response.
• 🎯 Built-in Threat Hunting Agent: We have built a powerful Threat Hunting Agent into the playbooks, capable of adapting to and handling all types of threat hunting
  scenarios.

SIRP Platform

• 🛠️ Fully-featured SIRP: The basic functions of the built-in SIRP (Security Incident Response Platform) are complete, providing a modern case management and response
  interface.
• 🔗 Deep Automation Integration: Implemented a Playbook-based UI interface, seamlessly integrating the powerful automation orchestration (SOA) capabilities of ASP with the SIRP
  user interface.

💬 Developer Notes: Origin and Vision

Initially, I just wanted to develop a pure backend framework for modularly processing alerts from SIEMs, leaving the user interaction to professional SIRP platforms like TheHive or
Splunk SOAR.

However, while exploring AI empowerment for the SOC, I realized that "automation" is an indispensable part, and AI Agents greatly enhance automation capabilities. True automation
requires deep interaction with the UI, so we ultimately decided to build in a fully-featured SIRP platform to provide a seamless experience.

Today, almost all security vendors, both domestic and international, are embracing AI Agents, but their products mostly serve their own commercial ecosystems. General SOAR
platforms often just add some LLM functional nodes.

ASP's vision is different: we aim to create an open-source, modularly customizable, AI-driven security operations platform. We believe that every organization should be able to
flexibly build its own intelligent security operations system according to its own needs.

0.1.0 is just the beginning. We look forward to growing with the community and exploring more possibilities in AI security.