Lab Guide: Unit 4 — Rapid Prototyping with Agentic Tools

cd ~/noctua-labs
git init soc-agent-system && cd soc-agent-system
git commit --allow-empty -m "init"
# Create worktrees for each agent component
git worktree add ../soc-recon   -b feature/recon-agent
git worktree add ../soc-analysis -b feature/analysis-agent
git worktree add ../soc-reporting -b feature/reporting-agent

cd ~/soc-recon
claude
# Prompt: "Build a recon security agent in Python using the Anthropic SDK.
# The agent receives raw alert text and must:
# 1. Extract all IoCs (IPs, hashes, CVEs, domains)
# 2. Use tool calls to enrich each IoC via the MCP tools
# 3. Return structured JSON: {iocs: [{type, value, enrichment, severity}], summary}
# Use claude-sonnet-4-6. Include error handling for failed tool calls."

cd ~/noctua-labs/soc-agent-system
claude
# Prompt: "Build orchestrator.py that coordinates three agents in sequence.
# Import: recon_agent.run(alert_text), analysis_agent.run(recon_json),
# reporting_agent.run(analysis_json, start_ts)
# Requirements:
# - 30s asyncio timeout per agent via asyncio.wait_for()
# - If recon times out: pass partial data to analysis with recon_status='timeout'
# - If analysis fails: reporting still runs with error summary
# - Return: {mtti_seconds, recon_status, analysis_status, report}
# - Log each stage with timestamp to structured JSON log"

mkdir -p ~/noctua-labs/unit4/sprint1
cd ~/noctua-labs/unit4/sprint1
git init
# Start building with Claude Code immediately — spec in context
claude
# Prompt: "I am building [your chosen system]. Here is my spec:
# [paste your 1-page spec]. Let's start with the core agent loop.
# Build [first component] first."

/check-antipatterns ~/noctua-labs/unit4/sprint1/

# Required: Zero CRITICAL findings to pass Sprint I
# Document: HIGH findings → deferred to Sprint II with justification
# Include: report output in Sprint I deliverables package

import logging, json, hashlib, time

class JSONFormatter(logging.Formatter):
    def format(self, record):
        return json.dumps({
            'ts': self.formatTime(record),
            'level': record.levelname,
            'event': record.getMessage(),
            'agent': getattr(record, 'agent', None),
            'tool': getattr(record, 'tool', None),
        })

# Use: logger.info("tool_call", extra={'agent':'recon','tool':'query_cve'})

/check-antipatterns ~/noctua-labs/unit4/sprint1/

# Track improvement:
# Sprint I:  CRITICAL __ HIGH __ MEDIUM __
# Sprint II: CRITICAL __ HIGH __ MEDIUM __
# Target: READY status (no CRITICAL or HIGH)

import anthropic, json, os

client = anthropic.Anthropic()  # uses ANTHROPIC_API_KEY from env

# ── STEP 1: Deploy the agent (run ONCE — save the IDs) ───────────────────────
# Paste your Sprint II system prompt below:
SYSTEM_PROMPT = """
[Your hardened Sprint II system prompt here — the one that passed AIUC-1 audit]
"""

agent = client.beta.agents.create(
    name="Unit 4 Sprint II — <your tool name>",
    model="claude-sonnet-4-6",
    system=SYSTEM_PROMPT,
    tools=[{"type": "agent_toolset_20260401"}],  # bash, file ops, web_search included
)
environment = client.beta.environments.create(
    name="unit4-sprint2-env",
    config={"type": "cloud", "networking": {"type": "unrestricted"}},
)

# Save IDs — you'll reuse these for every session
ids = {"agent_id": agent.id, "environment_id": environment.id}
with open("managed_agent_ids.json", "w") as f:
    json.dump(ids, f, indent=2)
print(f"Deployed: {ids}")

# ── STEP 2: Run a test session against your Sprint I test cases ───────────────
with open("managed_agent_ids.json") as f:
    ids = json.load(f)

session = client.beta.sessions.create(
    agent=ids["agent_id"],
    environment_id=ids["environment_id"],
    title="Test Session — Week 15",
)

test_input = "[Paste your Sprint I test case #1 here]"

with client.beta.sessions.events.stream(session.id) as stream:
    client.beta.sessions.events.send(session.id, events=[{
        "type": "user.message",
        "content": [{"type": "text", "text": test_input}]
    }])
    for event in stream:
        if event.type == "agent.message":
            for block in event.content:
                if hasattr(block, "text"):
                    print(block.text, end="", flush=True)
        elif event.type == "agent.tool_use":
            print(f"\n[Tool: {event.name}]", flush=True)
        elif event.type == "session.status_idle":
            print("\n\n── Session complete ──")
            break

gh pr create \
  --title "Sprint II: Threat Hunter v0.1.0 — Hardened" \
  --body "## Problem
Analysts spend 45 min/day triaging phishing alerts manually.

## What this does
3-agent system: classifier → enricher → reporter. 94% accuracy on test set.

## Architecture decisions
- Claude Sonnet for classification (cost/accuracy tradeoff)
- Async enrichment with 30s timeout + fallback
- Human escalation at confidence < 0.7

## Test coverage
- 23 unit tests, 4 integration tests, all passing
- Pre-landing checklist: all 7 items reviewed, 0 deferred

## Known gaps
- No rate limiting on the enrichment API (tracked in TODOS.md)
- Evaluation dataset is synthetic; production data may differ"