Hermes — Home Network Agent
An AI agent that watches for home network events, triages anomalies, and opens tickets so issues surface without watching a dashboard.
- Python
- MCP
- Security Onion
- LLM
01 / Problem A SIEM nobody watches
A home SIEM generates alerts. Most of them are noise — a printer scanning, an IoT device phoning home, a VPN reconnect after sleep. The signal-to-noise ratio makes it easy to stop looking. And when you stop looking, you miss the one alert that matters.
The answer isn’t a better dashboard. It’s an agent that does the first pass.
02 / System How Hermes works
Hermes is a Python agent wired into the home lab’s event sources via MCP. When Security Onion fires an alert, Hermes pulls the event context, looks up the source device in the network inventory, and makes a triage call:
- Is this device expected to talk to this destination?
- Is this traffic pattern normal for this VLAN segment?
- Does this match a known-noisy rule or a genuine anomaly?
Based on that, Hermes either suppresses the event (known noise, logged) or opens a ticket with the triage context already attached and notifies me.
03 / Guardrails What it doesn’t do
Hermes doesn’t make containment decisions. It surfaces and categorizes. A ticket from Hermes is the starting point for a human decision, not a substitute for one.
MCP connections are read-only. Hermes can pull device state and network context; it cannot change firewall rules or block traffic. The value is in the triage, not the automation of response.
04 / Status Where it stands
Core triage loop is running. The ticket system integration logs every agent action and the reasoning behind it. Next: expanding the detection rule context Hermes can reference and adding a confidence score to each triage output so the certainty of a call is visible alongside it.