Agentic AI framework integrating Suricata, OSQuery, Langflow, and MCP to automate network monitoring, endpoint visibility, and SOC investigation workflows. Built in a multi‑VM lab environment with MITRE Caldera adversary emulation, the system demonstrates explainable, reproducible automation for security operations.