EvidenceOps Agent

AI incident response workspace

Risk --
Confidence --
Evidence --
Response ETA --

Splunk-ready workflow

Saved searches become agent evidence, not black-box answers.

Data sources --
Tool calls --
Approval gates --

Judge proof pack

Concrete Splunk MCP and developer-tool evidence is in the repo.

MCP evidence pack Saved searches MCP tool manifest Mock MCP trace AppInspect checklist

Brand Portals edition

A complete brand system for the EvidenceOps product story.

Open brand portal Submission copy BrandKity transfer guide

Google Cloud Rapid Agent edition

Gemini turns the evidence packet into a grounded incident brief while MCP tools keep retrieval auditable.

Agent Builder flow triage -> retrieve -> brief -> approve
Gemini contract cite evidence, expose uncertainty, require approval
MCP handoff Dynatrace observability queries as callable tools
Rapid Agent edition Agent flow JSON Gemini prompt contract Partner MCP mapping Dynatrace trace sample

FIND EVIL terminal edition

A runnable DFIR agent validates claims, corrects overstatements, and logs every tool step.

Run path python3 agent.py evidence/oauth_token_theft_case.json
Self-correction confirmed exfiltration -> likely exfiltration
Traceability findings cite EV-001 through EV-006
Submission pack Evidence dataset Accuracy report Video script Execution log

Evidence Timeline

Submission Brief

draft