Agent IR Lab demo

This is a demo of Example 03 from the Agent IR Lab. A SOC analyst triages a Falco alert raised by an AI agent's sandbox, using a ticket queue, the agent's transcript, the host's Falco alerts, and a (fake) live-response shell.

Kestrel Analytics and its SOC tools are fictional; the transcripts, alerts, and folder listing are real captures from scripted agent runs.

Start with ticket SOC-4512. How would you resolve this ticket? How would a junior analyst resolve this ticket?

Source at github.com/chasehas/agent-ir-lab.

Start the walkthrough →

Solution (spoiler: try the walkthrough first)

The agent's transcript, and the AI summary of it, say the copy failed and no files were copied. A closer look at Falco and the folder listing shows two files were written to the shared output folder. Trusting the summary and resolving the ticket would have shipped a broken build with confidential data.