$ show Vigil-SOC/vigil
Vigil is an open-source AI SOC (Security Operations Center) platform that orchestrates autonomous threat hunting, incident response, and case management through a multi-agent architecture. The system ingests security findings from SIEMs (Splunk, Elastic, Azure Sentinel), EDRs (CrowdStrike, Microsoft Defender), and other sources via Kafka or webhooks, then uses LLM-driven agents (hunt, root_cause, adjudicate, investigate, compose, chat) to analyze, enrich, and respond. A TypeScript agent layer with event-sourced ledgers and budget enforcement runs investigations, while a Python daemon handles polling, deduplication, and orchestration. The platform exposes its own tools via MCP (Model Context Protocol) and integrates with 30+ external security tools through a descriptor-based plugin system. The frontend is a React SPA with a setup wizard, dashboards, and case management UI. Deployment is via Docker Compose or Helm, with PostgreSQL, Redis, and optional Kafka as backing services.
The LLM identified 8 files worth highlighting for reuse:
Provides a context manager for database sessions that commits on success and rolls back on failure, used across all case services. Encapsulates session lifecycle and repository access, making it extractable for any SQLAlchemy-based project.
Defines a descriptor registry for vendor integrations. Each vendor provides a descriptor.py that registers itself; the registry scans core/integrations/*/descriptor.py at import time. This pattern allows adding new integrations without modifying core code and is reusable for any plugin-based system.
Implements an in-process MCP server that wraps Vigil's own tools (findings, cases, detections) for external consumption. Normalizes errors, returns tool results shaped like remote calls, and registers the server in the MCP registry. Demonstrates a clean pattern for exposing internal APIs via MCP without spawning subprocesses.
A generic, reusable React data table component with column definitions (ColumnDef<T>), sorting, searching, pagination, and phase states (loading/error/ready). Uses a generic type parameter for type-safe column rendering. Easily extractable for any React project needing a data table.
Estimates LLM call costs across providers (OpenAI, Anthropic, Ollama, Vertex) using registry-priced rates and token counting (tiktoken, Anthropic count_tokens, char heuristic fallback). Returns cost bands with pricing source labels. Demonstrates a robust fallback pattern and is reusable for any project needing LLM cost estimation.
Event-sourced ledger for agent runs, storing events in PostgreSQL and supporting fold/projection operations. Used for replay, resumption, and verification (hash chain). The pattern is domain-free and could be extracted for any event-sourced system.
Tool output sanitization that escapes only '<' to prevent prompt injection, with idempotent wrapping. Also scans for instruction-like patterns. Demonstrates a minimal, targeted security pattern that is reusable for any LLM tool integration.
Defines RouterMeta dataclass for declarative API router mounting with auth posture, enabled predicate, and legacy prefix support. Auto-discovers routers by file naming convention. Reusable pattern for any FastAPI project needing structured router registration.