# Devpost Answers

Use this file when filling out the project submission forms. Adjust the links after you create the GitHub repo, deployment URL, and demo video.

## Universal

### Project Name

EvidenceOps Agent

### Tagline

Explainable AI incident response with evidence timelines, multi-agent reasoning, and human approval gates.

### What It Does

EvidenceOps Agent is an AI incident response workspace for security teams. It turns fragmented alerts from identity, OAuth, endpoint, storage, DLP, proxy, backup, and developer systems into a clear investigation packet.

The demo supports three replayable scenarios: OAuth token theft, ransomware prelude, and insider exfiltration. For each scenario, the agent builds an evidence timeline, generates a risk score, explains the reasoning behind the score, shows a Splunk-ready MCP-style tool trace, creates a human approval queue for high-impact response actions, and drafts an incident report that can be copied or downloaded.

### Inspiration

AI-driven attacks move faster than traditional incident response. Human analysts still need to gather logs, reconstruct timelines, explain confidence, and decide which containment actions are justified. EvidenceOps Agent is designed as the analyst cockpit for that moment: fast enough for agentic response, but explainable enough for a human to trust.

### How We Built It

The current prototype is a static HTML, CSS, and JavaScript application using mock security telemetry. The data model separates alerts, evidence timeline events, scoring rules, Splunk data source coverage, MCP-style tool traces, approval gates, and response steps. The interface renders the investigation as an analyst workspace with a left alert feed, central evidence timeline, right-side agent reasoning, tool trace, approval queue, and a report panel.

The architecture is intentionally easy to extend: the mock telemetry can be replaced with Splunk searches, SIEM results, MCP tools, or endpoint triage outputs without changing the user workflow.

### Challenges

The main challenge was balancing automation with trust. An incident response agent should not blindly revoke accounts or block file servers just because a model says so. The prototype therefore separates agent reasoning from human approval gates and keeps evidence references visible.

Another challenge was creating a demo that works without requiring judges to configure cloud credentials. The current app is runnable as a static site, while the architecture and documentation describe how it would connect to Splunk, SIFT, MCP tools, or ticketing systems.

### Accomplishments

- Built a complete incident response dashboard that runs locally or as a static deployment.
- Added three security scenarios for stronger judging demos.
- Added explainable scoring, evidence timelines, Splunk-ready tool traces, generated reports, and approval gates.
- Created a submission pack, deployment guide, screenshot, and demo script.

### What We Learned

Agentic security tools need more than speed. They need clear evidence handling, bounded action permissions, and audit-friendly explanations. The most compelling workflow is not "AI replaces the analyst"; it is "AI reconstructs the case quickly and lets the analyst approve the risky steps."

### What's Next

- Connect the mock telemetry to Splunk saved searches and Splunk MCP Server.
- Add SIFT/DFIR artifact parsers for disk, memory, and endpoint evidence.
- Add structured agent execution logs with timestamps and tool calls.
- Export reports to Markdown, Jira, Slack, or PDF.
- Add an accuracy benchmark that compares agent findings against known incident ground truth.

### Built With

HTML, CSS, JavaScript, mock SIEM telemetry, agent workflow design.

### Repository URL

https://github.com/1kai123/evidenceops-agent

### Demo URL

https://1kai123.github.io/evidenceops-agent/

### Demo Video URL

https://youtu.be/9U1Q8vSjjBw

## Splunk Agentic Ops Hackathon

Use `SPLUNK_SUBMISSION_READY.md` for the most focused Splunk-specific copy.

### Track

Security.

### Splunk Positioning

EvidenceOps Agent is designed as an agentic SecOps layer on top of Splunk data. In the production version, each scenario input would be generated by Splunk searches across identity, OAuth, endpoint, storage, DLP, proxy, backup, and developer telemetry. The agent workflow would use Splunk MCP Server or Splunk APIs to retrieve events, group them into an evidence timeline, score the incident, and draft response steps. The demo now exposes this mapping directly with a Splunk-ready workflow strip and MCP-style tool trace cards.

### How It Uses AI

The prototype simulates the AI reasoning layer with deterministic scoring rules so judges can inspect the workflow without external credentials. The intended AI layer performs three tasks: evidence collection, threat assessment, and response drafting. These map naturally to Splunk AI capabilities and agentic workflows.

### Architecture Note

Include `ARCHITECTURE.md` in the repository root. The diagram shows Splunk data flowing into the Evidence Collector agent, then Threat Assessor, Response Drafter, Human Approval, and containment/ticketing outputs.

### Submission Requirements Check

- Text description: use this file.
- Demo video under 3 minutes: use `VIDEO_SHOTLIST.md`.
- Public open-source repository: create GitHub repo and include MIT license.
- README with run instructions: included.
- Architecture diagram in repo root: included in `ARCHITECTURE.md`.
- Splunk integration details: included in `SPLUNK_INTEGRATION.md`.

## FIND EVIL!

### Best Fit

Use this project as a foundation, but FIND EVIL has stricter requirements than the current static prototype. The event expects work around Protocol SIFT, SANS SIFT Workstation, case data, architecture boundaries, accuracy reports, and execution logs.

### Positioning

EvidenceOps Agent can be adapted into an "Analyst Training Loop" or "MCP-Connected Live Triage" project. The current UI demonstrates the analyst-facing output; the next build step should add a mock or real MCP tool log and an accuracy report.

### Gap Before Final Submission

- Dataset documentation is started in `DATASET.md`.
- Accuracy report is started in `ACCURACY_REPORT.md`.
- Structured agent execution logs are mocked in `EXECUTION_LOG_SAMPLE.md`.
- SIFT/Protocol SIFT integration is documented in `SIFT_DFIR_INTEGRATION.md`.

## Band of Agents

### Track Fit

Regulated & High-Stakes Workflows or Internal Enterprise Workflows.

### Multi-Agent Framing

EvidenceOps Agent is a coordinated multi-agent incident response workflow:

- Evidence Collector: gathers and normalizes alerts.
- Threat Assessor: scores the case and maps the attack sequence.
- Response Drafter: writes a report and action plan.
- Approval Coordinator: separates high-impact actions from fully automated steps.

### Why It Fits

Security incident response is high-stakes enterprise work. The demo shows agents exchanging context, coordinating a shared timeline, and escalating risky actions to a human approval queue.
