LangGraph Agent:
Indicator of Compromise reporting
AI SYSTEM · OBSERVABILITY · DEMO APPLICATION
| See the full project on github ↗
A LangGraph and LangChain agent that evaluates indicators of compromise, correlates threat intelligence, and exposes each decision through OpenTelemetry.
This LangGraph agent accepts IP addresses, domains, URLs, file hashes, CVEs, and software packages. It queries the relevant threat-intelligence sources in parallel, normalizes their results, calculates a severity rating, and returns a structured report.
The project includes a FastAPI interface, deterministic demo and live modes, OpenAPI-derived contract tests, CI validation, and presenter-ready documentation.
Why it matters
This agent makes the workflow for investigating Indicators of compromise inspectable and repeatable. OpenTelemetry captures execution behavior, while deterministic demo mode allows the application and its API contract to be demonstrated without relying on external services or credentials.
Core features
Query multiple threat-intelligence providers in parallel.
Trace agent decisions and external calls with OpenTelemetry.
Switch between live and deterministic demo modes.
Validate API contracts against the generated OpenAPI schema.
Run the same Postman test suite locally and in CI.
What this work demonstrates
A production-minded approach to AI demonstrations: build the agent, instrument its behavior, define its API contract, test its failure paths, and package it so another person can run and present it reliably.