protocol-sift-agent

Autonomous incident-response agent built for the FIND EVIL hackathon (SANS / Protocol SIFT). Triages a SIFT case end-to-end on a Gemini 2.5 + Google Cloud Agent Builder (ADK) stack, walking a Protocol SIFT MCP server and visibly self-correcting when surface "malware" indicators get overturned by deeper forensic evidence.

Why self-correction

Most production "malware" alerts are false positives caused by sanctioned admin tooling that shares surface indicators with real attacks (runs from %TEMP%, scheduled-task triggered, base64 PowerShell). A good Tier-2 analyst forms a working hypothesis fast, then revises it loudly when the signature, IOC feeds, parent process, and change-management record disagree. The agent's system prompt forces that pattern into the output.

Stack

• Model: Gemini 2.5 Flash via Vertex AI
• Agent runtime: google.adk.agents.LlmAgent + McpToolset
• MCP: Protocol SIFT tool surface — list_artifacts, examine_binary, compute_hash, check_ioc, get_process_tree, query_event_log, list_persistence_mechanisms
• Dashboard: Streamlit, Cloud Run deployable
• License: Apache 2.0

The canned case

CASE-2026-0518-001 is wired into the stub MCP so judges can reproduce the self-correction without any cluster setup. Three artifacts attached:

Artifact	Surface look	Deep truth
update_helper.exe in C:\Windows\Temp	obfuscated strings + scheduled-task triggered + run from temp	Microsoft-signed, IOC-clean, parent is DOMAIN\svc_endpoint_admin (sanctioned service account)
PowerShell evtx with base64 + iex	suspicious	logged from approved Endpoint Manager IP under change CR-2026-MAY-0517
\Microsoft\Windows\IT\NightlyMaintenance scheduled task	nightly recurring, runs as SYSTEM	412 days old, owned by endpoint-management@acme.example, matches org baseline

A naive analyst (or a too-confident LLM) calls this MALWARE CONFIRMED. A complete walk through the tools forces the verdict to flip to FALSE POSITIVE — sanctioned admin activity.

Output contract

The system prompt requires exactly these labeled sections:

CASE: <case id>
INITIAL HYPOTHESIS: ...
EVIDENCE GATHERED: signature / iocs / process tree / logon / change window / persistence
SELF-CORRECTION: ...
FINAL VERDICT: TRUE POSITIVE / FALSE POSITIVE / INCONCLUSIVE
EVIDENCE TRAIL: ...
NEXT STEP: ...

If INITIAL HYPOTHESIS != FINAL VERDICT, the SELF-CORRECTION paragraph must name the exact evidence that flipped it.

Run it

pip install -e .
python -m streamlit run app/dashboard.py

To use a real Protocol SIFT MCP server instead of the stub, flip the sidebar toggle and set SIFT_CASE_ENDPOINT + SIFT_API_TOKEN.

Tests

pip install -e ".[dev]"
pytest -q

The test suite locks in the self-correction contract: surface indicators are suspicious, deep indicators are clean, and the stub keeps them consistent across runs so the agent is graded fairly.

Repo + demo

• Code: https://github.com/MukundaKatta/protocol-sift-agent
• Cloud Run: https://protocol-sift-agent-1029931682737.us-central1.run.app
• Demo video (YouTube unlisted): https://youtu.be/bcPKeo6DPXM

Apache 2.0. Built standalone during the FIND EVIL contest period.