Cyber Threat Intelligence Triage Agent using Claude Agents SDK and Pydantic AI
Advanced APT hacking campaigns targeting financial infrastructure demand rapid multi-modal forensic triage and automated mitigation recommendations. Build an autonomous threat triage agent with the Claude Agents SDK and Pydantic AI to ingest network telemetry, evaluate indicator confidence, and trigger firewall rule updates. Achieve 95% accuracy on incident severity classification and automated response generation.
What you are building
Develop an autonomous forensic triage agent using Claude Agents SDK and Pydantic AI to analyze cyber telemetry and automate incident containment.
How work is evaluated
Tests agent ability to correctly classify APT threat severity and generate valid containment payloads.
Datasets
Public datasets, plus the private datasets you have access to.
How submissions are scored
schema_validation_test
Verifies output conforms to required Pydantic model
This dimension contributes its full weight only when the submission satisfies the requirement. Partial credit is not awarded.
severity_accuracy
Accuracy score of assigned incident severity • target: 0.95 • range: 0-1
This dimension contributes its full weight only when the submission satisfies the requirement. Partial credit is not awarded.
Learning goals
Build a type-safe telemetry parser with Pydantic AI models
Orchestrate forensic analysis workflows using Anthropic Claude Agents SDK
Construct dynamic mitigation rule actions based on attack vectors
Evaluate APT threat indicators with high confidence and minimal false alarms
Resources
Synthetic telemetry dataset representing APT intrusion attempts against core banking infrastructure.
Challenge setup
Tests agent ability to correctly classify APT threat severity and generate valid containment payloads.
Challenge input
JSON telemetry log with PCAP highlights and netflow data
Claude Agents SDK
Agentic framework for Anthropic models
Pydantic AI
Guarantees structured telemetry output
Evaluated output
Pydantic JSON model with severity, confidence, and firewall blocking parameters
- Verifies output conforms to required Pydantic model
- Accuracy score of assigned incident severity • target: 0.95 • range: 0-1
- Benchmark: CyberThreat-Eval
- Severity Accuracy target: 0.95
- 1 public reference case
- Python execution harness
- Python sandbox (unavailable on Versalist)
Shows the first task, up to three tools, and up to three evidence items.
View technical recipe
Configured tools
- Pydantic AI · Required
- Claude Code · Optional
- Claude Code · Optional
- Claude 4.1 Opus · Optional
- Pydantic AI · Required
Evaluation contract
- schema_validation_test · Weight 1
- severity_accuracy · Weight 1
Metrics
- severity_accuracy · Target 0.95
Benchmarks
- CyberThreat-Eval
- security
Reference cases
- 1 public reference case
Workflow tasks
- Task 1
Input: JSON telemetry log with PCAP highlights and netflow data
Output: Pydantic JSON model with severity, confidence, and firewall blocking parameters
Execution harness: Python
Evaluation tools
- Claude Agents SDK · Agent Orchestration
- Pydantic AI · Type Validation
Recipe freeze marker
No recipe freeze time is recorded.