Agent skill · security · aradotso
securityclaw-autonomous-soc-agent
Deploy and operate SecurityClaw, an autonomous SOC agent with RAG-based threat detection, LLM-powered anomaly analysis, and skill-based security automation
Why this skill is useful
Adds executable scripts and a modular framework for autonomous security operations that significantly enhance threat detection and anomaly analysis capabilities.
What it needs
Requires ollama, python installed locally. Requires abuseipdb, maxmind, opensearch, virustotal account access. About 8k tokens when loaded. Last updated 2026-08-04. 11 stars on the source repository.
What this skill does
SecurityClaw Autonomous SOC Agent Skill by ara.so — Security Skills collection. SecurityClaw is a modular, skill-based autonomous Security Operations Center (SOC) agent that monitors OpenSearch/Elasticsearch data, builds RAG-based behavioral memory, and validates real-time anomalies using LLMs. It orchestrates security workflows through LangGraph, maintains conversation-based investigations, and provides both CLI and web interfaces for threat analysis. Core Capabilities Skill-based architecture: Each capability is an isolated module with Python logic + LLM instruction RAG behavioral memory: Vector embeddings of network baselines stored in OpenSearch Anomaly detection: Scheduled 1-minute watcher polls findings and escalates threats LLM-powered analysis: Threat analyst validates anomalies using retrieval-augmented context LangGraph orchestration: DECIDE→EXECUTE→EVALUATE supervisor loop with SQLite checkpointing Web + CLI interfaces: React UI for chat investigations, CLI for automation Provider agnostic: Swap OpenSearch↔Elasticsearch, Ollama↔other LLM providers Installation Prerequisites Setup The onboarding wizard configures: OpenSearch/Elasticsearch connection (host, port, SSL, auth) LLM provider (Ollama endpoint, model names) Optional external APIs (AbuseIPDB, VirusTotal, MaxMind GeoIP) Skill-specific environment variables Outputs config.yaml and .env with validated configuration. Configuration config.yaml Structure Environment Variables (.env) CLI Commands Service Management Skill Operations Configuration Management Skill Development Creating a New Skill Skills are directories in skills/ with two required files: skills/myskill/instruction.md (LLM guidance + metadata): skills/myskill/logic.py (Python implementation): The skill is auto-discovered on next run. Set scheduleintervalseconds in instruction.md to enable automatic execution. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills aradotso/securityclaw-autonomous-soc-agent