secmon-lab/warren

Builds multi-agent investigation workflows orchestrated through Slack, where specialized sub-agents (BigQuery, CrowdStrike Falcon, threat intel tools) autonomously query data sources in parallel. Uses LLM-driven reflection to extract and score investigative claims as vector-embedded memories that improve triage accuracy over time. Ingests alerts via webhook/Pub/Sub/SNS, applies Rego policies for transformation and triage decisions, and surfaces findings through Slack threads with real-time agent progress traces or a React dashboard.