Splunk Agentic Ops Hackathon

Turn Splunk alerts into analyst-ready incident briefs.

BreachPilot uses an agentic MCP workflow to collect evidence, correlate security events, score risk, and recommend response actions.

--events correlated

--risk signals

--MCP tool calls

Risk score

Waiting

Start an investigation to build an evidence-backed incident brief.

-- /100

Confidence

-- evidence-backed verdict

Runtime

-- local agent latency

Correlated attack path

Case waiting

Run an investigation to reveal the kill-chain path.

Agent plan

human-in-the-loop

Response

prioritized

Evidence

grouped by signal

Timeline

0 events

Splunk transparency

scoped, auditable searches

Debug payload

{}