// cat ./projects/snock.md
Snock
Autonomous Cloud Security AI Agent
A hybrid GraphRAG + VectorRAG security platform on Neo4j and ChromaDB. An agentic pipeline built on the Model Context Protocol (MCP) performs deterministic tool routing — isolating graph analysis from semantic retrieval to suppress LLM hallucination during cloud investigations.
## Problem
Cloud investigators drown in disconnected telemetry — IAM, network, workload, and identity context live in separate consoles. Conventional LLM copilots hallucinate when asked to reason across these surfaces because they conflate graph structure ("who can reach what") with semantic retrieval ("what should we do about it").
## Why existing solutions fail
Single-store RAG systems blend structural and textual knowledge into one vector index, losing the deterministic edges an attack path requires. CSPM tools list misconfigurations but never reason across them. Snock separates the two reasoning modes so each is grounded in the right substrate.
## Architecture
Live AWS telemetry is ingested through Boto3 into a Neo4j attack-path graph. CIS Benchmarks, MITRE ATT&CK, and internal runbooks are embedded into ChromaDB. An MCP server exposes deterministic tools (graph.query, vector.retrieve, terraform.patch) which the agent selects via tool routing — never free-text reasoning over raw data.
## Detection Engine
A YAML-driven detection engine identifies multi-hop attack paths — IAM privilege escalation chains, SSRF pivot routes, exposed workloads with lateral movement potential, and over-privileged service roles. Each finding is enriched via VectorRAG with context-aware remediation guidance before reaching the operator.
## Auto-Remediation
When a finding is confirmed, Snock correlates graph-discovered vulnerabilities with retrieval-grounded guidance and emits Terraform patches as pull requests. Operators stay in the loop — every patch ships with the attack path, the matching control, and a confidence score.
## Lessons Learned
Hallucination is largely a routing failure, not a model failure. Once the agent is forced to call deterministic tools for structural questions, the reasoning quality collapse that plagues monolithic copilots disappears.
## Roadmap
Azure & GCP graph ingestion, runtime EDR signals fused into the graph, and a confidence-weighted auto-merge mode for low-risk Terraform patches.
// ls ../
RESEARCH
SpecterHeal →
AI-Assisted Self-Healing Infrastructure
PRODUCTION
Enterprise DDoS Defense →
AWS Shield Advanced & Firewall Manager Automation
PRODUCTION
Hardened GitLab DevSecOps Platform →
Secure CI/CD with Terraform, tfsec, Trivy, SonarQube
ENGAGEMENT
Trend Micro XDR Remediation →
Enterprise Endpoint Detection & Response Tuning
PRODUCTION
AWS Incident Response Automation →
Event-Driven Containment with Lambda + CloudWatch
PRODUCTION
SOC Automation & Visualization →
TheHive + Elasticsearch + Grafana + n8n
PRODUCTION
Fortinet SD-WAN Deployment →
Resilient Multi-Site Connectivity
INTERNAL
CTF Training Platform →
Practical Cybersecurity Training Lab
PRODUCTION
Cloud Monitoring & Observability Platform →
Terraform, ECS Fargate, cross-account CloudWatch
DELIVERED
CIS Benchmark & Remediation Program →
Measured posture improvement across a DevOps platform
DELIVERED
Open Banking Auth Flow Load Testing →
k6, mTLS, FAPI/OAuth2 with PAR, browser-driven SCA