CyBe Agentic
AI SOC Engineer

Design and build a Tier-1 AI triage agent using the Anthropic SDK.

• ›Ch 1: The Brief -- design doc, data flow, decision boundary
• ›Ch 2: The Classification Engine -- fine-tuned prompt + few-shot chain-of-thought
• ›Ch 3: Tool Use -- AbuseIPDB, Shodan, VirusTotal integrations
• ›Ch 4: Escalation Logic -- threshold tuning, precision vs recall tradeoffs
• ›Ch 5: Governance -- audit logging, explainability, human-in-loop gates
• ›Ch 6: Adversarial Testing -- red-team your own agent, document failure modes
• ›Ch 7: Production Deployment -- validate against 300 historical alerts, measure FP rate

Hunt Silent Phantom's reactivation footprint. Your agent catches the first Notion C2 alert -- but the attacker left 6 more indicators it cannot see.

• ›Ch 8: The Reactivation Signal -- Lambda backdoor forensics, CloudTrail pivot
• ›Ch 9: IAM Forensics -- privilege escalation timeline reconstruction
• ›Ch 10: Lambda Persistence -- function versioning, dead-drop C2 detection
• ›Ch 11: Multi-Source Correlation -- CloudTrail + endpoint + LLM audit logs
• ›Ch 12: Adversarial Hunting -- hunt for what the AI agent missed
• ›Ch 13: Hunt to Detection -- convert hunt findings to production KQL rules
• ›Ch 14: CISO Debrief -- written attribution report, ATT&CK + ATLAS mapped