EvidenceOps Agent

# AI incident response workspace

Scenario
Risk --
Confidence --
Evidence --
Response ETA --

Splunk-ready workflow

## Saved searches become agent evidence, not black-box answers.

Data sources --
Tool calls --
Approval gates --

Judge proof pack

## Concrete Splunk MCP and developer-tool evidence is in the repo.

MCP evidence pack Saved searches MCP tool manifest Mock MCP trace AppInspect checklist

Brand Portals edition

## A complete brand system for the EvidenceOps product story.

Open brand portal Submission copy BrandKity transfer guide

Google Cloud Rapid Agent edition

## Gemini turns the evidence packet into a grounded incident brief while MCP tools keep retrieval auditable.

Agent Builder flow triage -> retrieve -> brief -> approve
Gemini contract cite evidence, expose uncertainty, require approval
MCP handoff Dynatrace observability queries as callable tools
Rapid Agent edition Agent flow JSON Gemini prompt contract Partner MCP mapping Dynatrace trace sample

FIND EVIL terminal edition

## A runnable DFIR agent validates claims, corrects overstatements, and logs every tool step.

Run path python3 agent.py evidence/oauth_token_theft_case.json
Self-correction confirmed exfiltration -> likely exfiltration
Traceability findings cite EV-001 through EV-006
Submission pack Evidence dataset Accuracy report Video script Execution log

## Alert Feed

## Evidence Timeline

## Agent Reasoning

Load the scenario, then run the agent to produce an incident brief.

### Human Approval Queue

### Splunk MCP Tool Trace

## Submission Brief

draft