Starter pack for building an AI SOC analyst on top of Vectra AI — AGENTS.md + agent skills + Vectra MCP wiring
This repository also configures its own agents. See what vectra-soc-agent-starter tells them →
vectra-ai-research/vectra-soc-agent-starter
Skill Claude CodeCodex needs its repo
Searches and hunts over Vectra metadata in two modes — (1) ad-hoc Investigation Query SQL using pre-validated recipes for network sessions, DNS, HTTP, TLS/X.509, SMB, Kerberos, NTLM, LDAP, RDP, DCE-RPC, SSH, SMTP, DHCP, RADIUS, beacons, IDS matches, and Entra/M365/AWS CloudTrail/Azure CP; (2)…
vectra-ai-research/vectra-soc-agent-starter
Skill Claude CodeCodex needs its repo
Primary Vectra AI tier-1 SOC analyst orchestrator. Routes requests to the right workflow (queue triage, entity deep-dive, single-detection pivot, TI hunt, ad-hoc investigation, canned report, PCAP triage), runs detection-category playbooks (Exfiltration, Lateral Movement, etc.), and lands a four-outcome verdict (BTP /…
vectra-ai-research/vectra-soc-agent-starter
Skill Claude CodeCodex
Pulls the PCAP attached to a Vectra network detection via the MCP server, decodes it to disk, and runs a structured tshark triage pass — TLS Client Hello tuples (SNI, JA3, cipher, ALPN, JA4), HTTP auth, NTLM/Kerberos, SMB shares, RPC bindings, DNS history, SSH, and ProcessCommandLine strings — to feed evidence back…
vectra-ai-research/vectra-soc-agent-starter
Skill Claude CodeCodex needs its repo
Renders canned Vectra AI dashboard reports via the MCP channel (no Python venv required). The user must explicitly name a report from the catalog — active connections, C2 beacon report, DNS error rate, flow records, HTTP status codes, NPM active TCP/UDP connections, protocol distribution, remote access sessions, RPC…
vectra-ai-research/vectra-soc-agent-starter
Skill Claude CodeCodex needs its repo
Renders canned Vectra AI dashboard reports via the Python channel. The user must explicitly name a report from the catalog — active connections, C2 beacon report, DNS error rate, flow records, HTTP status codes, NPM active TCP/UDP connections, protocol distribution, remote access sessions, RPC latency, SaaS…
vectra-ai-research/vectra-soc-agent-starter
Skill Claude CodeCodex
Enriches Vectra findings with VirusTotal threat intelligence — IOC reputation lookup for IPs, domains, URLs, and file hashes via the VirusTotal v3 API. Ships two paths — a standalone Bash CLI (scripts/vt-lookup.sh) for one-off lookups that needs only curl/jq, and a sourced framework adapter (scripts/virustotal.sh) for…
At most 3 mods per repository are shown here, and a mod shipped inside a plugin is left to that plugin's page — the rest are on their repository pages: