Hunt the real threats.
Leave the noise.
socxen is an agentic SOC skill suite for Exabeam New-Scale — a plugin for Claude Code and OpenAI Codex. It works an alert to a written verdict, sweeps the queue, and finds the rules wasting your analysts' time. Most agent skills are a markdown file. This one is engineered for the fact that SIEM data is untrusted input: guardrails around every read and write, a human gate on every consequential action, and a release process that proves it.
Three skills, one governance gate
Analyst. Shift lead. Detection engineer.
Each skill is named for the person whose job it does. They hand off to each other — a single case to the analyst, a noise cluster to the engineer — and share one safety spine: the same untrusted-data doctrine, the same write gate, the same audit trail.
soc-investigate
Takes one alert or case from first look to written verdict: pulls the events, pivots on the entities it finds, weighs the activity against what is normal for them, tests a benign explanation against a malicious one — and writes it up with the evidence behind every line.
"investigate alert 8f67ee43"
triage-cases
Sweeps the open queue instead of one case — clusters by attack shape, ranks by corroborated signal rather than risk score alone, and hands back a short "start here" list plus the noise worth tuning. Read-only across the sweep; it never closes in bulk.
"triage the queue"
rule-tuning
Finds the rules quietly wasting analyst attention — noisy, not merely loud — and proposes the specific change, mapped to real Exabeam mechanics. Propose-only: there is no rule-write path, and that is deliberate.
"find noisy rules"
In five minutes
Install. Connect. Hunt.
No server, no database, no approval queue — a plugin in the coding agent you already run, and the analyst at the terminal is the human-in-the-loop. The four steps and the commands ↓
Built in, not bolted on
SIEM data is untrusted input. Build like it.
An attacker can write to your logs — a user-agent string, a case note, a "baseline" pasted into an alert. If you expose that data to an agent with tools, you need a plan for what happens when it lies. socxen's plan is code you can read and tests you can run, at every layer between the data and an action.
- Two locks on dismiss/close, out of the box — a gate the plugin ships and the host enforces stops the call at the harness, and the skill asks you first. Never left to the model alone.
- Containment is recommended, never executed — isolate, disable, block: the plugin can propose them and cannot perform them. Denied at the harness as defense in depth.
- Evidence has provenance — a baseline is something the agent queried, not something the alert supplied. Planted "context" does not count — the doctrine that closed the one attack no guardrail could catch.
- Reads are canonicalized — invisible-character smuggling is stripped before the model reasons about what it read.
- Writes are neutralized — formulas and clickable links are defanged, secrets and PII redacted, before anything persists to Exabeam. Deterministic code at the bridge, not a prompt.
- Every call is audited — a local, metadata-only trail of what was called, when, and with what result. Nothing phones home.
What the code stops, and what it deliberately doesn't →
The gate
A human before anything is dismissed or closed — enforced by the host, not the model
On the moment the plugin is enabled, with nothing to merge: the same allow / ask / deny tiers, generated from one source, land on each host the way that host enforces them. Containment is denied outright; dismiss and close ask; reads run without a prompt; a tool nobody has classified asks rather than running.
A hook that ships in the plugin
Active the moment the plugin is enabled: ask on dismiss and close, deny on every containment verb, ask on anything unclassified — and it holds even under --dangerously-skip-permissions. The permission pack (same tiers, one source) is the optional second layer.
Policy that ships inside the package
The same tiers as Codex tool-approval modes. Destructive tools require a human in every mode and are canceled when nobody is present — fail closed, codex exec included.
Nothing above is a claim. Twenty attack fixtures, five trials each, on the weakest supported model per host, before every release — and the dated results ship with the code. The numbers ↓
Five separable layers
A skill is a markdown file. This is a system.
Keeping the layers separate is the point: the model holds the judgment, the code holds the enforcement, and the process proves both — every release.
The procedures
Entity pivots, baselining by querying, competing hypotheses, an evidence bar, stopping conditions, an action matrix — in SKILL.md, shared across all three skills as one safety spine and enforced by invariant tests.
The Exabeam MCP, bundled
SIEM search, alerts and cases, threat timelines, rule and MITRE context — reached through a local bridge that ships with the plugin for each host, never wired by hand.
Who may do what, enforced by the host
Allow, ask, deny — generated from one source, pinned by tests, enforced by Claude Code's permission rules or Codex's tool-approval policy. Not by the model.
The bridge treats telemetry as hostile
Canonicalize on read, neutralize on write, refuse containment outright, and record a metadata-only audit trail of every call. Deterministic Python you can diff.
The process ships with the code
A red-team corpus that gates every release, a Praxen behavior scan against a written remit, and a CycloneDX AI bill of materials regenerated with every version and drift-checked in CI.
The process ships with the code
Scanned, red-teamed, inventoried — every release
Nothing here is a claim. Twenty attack fixtures across four classes, five trials each, on the weakest supported model per host; an independent behavior scan; a machine-readable bill of materials. Dated artifacts, committed with the release.
Attack history
Every run since the first, with what landed, what was fixed, and the re-verification. Including the one finding no guardrail could have caught — and how doctrine closed it.
A bill of materials for the agent
CycloneDX: the models, the tool surface, the connector dependencies, and the governance controls — regenerated with every version and drift-checked in CI, so what you install is what the inventory says.
Agent behavior verification
socxen is scanned by Praxen, its sister project, against a written Worker Remit before each release: zero Critical findings is the bar.
Get started in minutes
Four steps. Two commands.
Install the plugin
One marketplace add and one install, on Claude Code or Codex. The Exabeam MCP bridge comes bundled — nothing else to wire.
Add credentials
A single ~/.exabeam-mcp.env with your New-Scale API key. The bridge refreshes the token itself.
The gate is already on
It ships inside the plugin on both hosts — a hook on Claude Code, approval policy on Codex. Reads run without a prompt too — nothing to merge.
Ask
"Investigate alert X." socxen gathers evidence, writes the verdict, and asks you before anything is dismissed or closed.
The commands
socxen runs as a plugin in your coding agent. One command adds the community marketplace and installs it. Add your Exabeam credentials and hunt — the human-in-the-loop gate is already on.
Full guide: Installation & setup · Operator's guide
# install socxen in your terminal $ claude plugin marketplace add open-agent-ai-security/plugins $ claude plugin install socxen@open-agent-ai-security # optional second lock: merge the permission pack $ git clone https://github.com/open-agent-ai-security/socxen.git $ cd socxen && ./plugin/install.sh --merge-permissions # then, in Claude Code > investigate alert 8f67ee43-bfa0-4f84-a5d0-42f97d893aed
# install socxen in your terminal $ codex plugin marketplace add open-agent-ai-security/plugins $ codex plugin add socxen@open-agent-ai-security # the gate ships inside the package — nothing to merge $ codex plugin list # then, in Codex > investigate alert 8f67ee43-bfa0-4f84-a5d0-42f97d893aed
Pre-release software, for evaluation. Expect breaking changes between versions; keep a human reviewing every action. Incubator project level.
Put a hunter on the queue — one built for hostile data.
Open source, Apache-2.0, built in the open with the Open Agent and AI Security Community.