# SecurityClaw

An autonomous security-operations-center agent that watches OpenSearch or Elasticsearch log data, builds a retrieval-augmented memory of normal behavior, and uses a large language model to validate whether a detected anomaly is a real threat.

SecurityClaw runs a heartbeat scheduler with a frequent anomaly watcher and a periodic memory builder, using capabilities implemented as isolated skill folders, each pairing Python logic with a markdown instruction file that guides the language model. A supervisor loop follows a decide, execute, evaluate cycle implemented as a LangGraph state graph, with planning and retry steps repaired against the currently loaded skill manifests so the system does not invent tool names that were never registered, and conversation and scheduler working memory are checkpointed to SQLite so state survives a restart.

It is provider-agnostic between OpenSearch and Elasticsearch, and between AI providers, supporting a remote endpoint or a local Ollama model reachable through an environment variable. Portable launcher scripts for POSIX shells and native PowerShell start either a local virtual-environment application or a Docker Compose stack, check that configuration, Ollama, Docker and OpenSearch are in place, and expose chat, skills and log commands alongside the usual start, stop and status controls; the managed OpenSearch container is kept from auto-restarting.

Website: https://github.com/SecurityClaw/SecurityClaw