Building an Agentic Security Operations Center | Harvey

This post details the architecture and implementation of Harvey's Agentic Security Operations Center (SOC). Key contributions include the concept of a 'security world model' built on a high-volume ClickHouse data layer, an MCP server for agent tool access, and a threat model system prompt. It outlines a four-phase agent pipeline for threat research and detection engineering, and describes continuous alert tuning workflows that have led to a 5.7x increase in coverage with a 95% reduction in alert space. The post emphasizes the importance of investing in the data layer before agents and highlights the productivity win of pairing humans with agents for judgment and tedium respectively.