Agentic alert investigation
An LLM agent investigates the alert the way a junior analyst would: it queries the SIEM and the EDR, builds a timeline and proposes a verdict with its evidence. An analyst approves anything that changes state.
The problem
Alert queues grow faster than teams. First-level investigation is repetitive but not trivial, since it needs queries against several tools and a judgment on what the results mean. Scripted playbooks cover the known cases and stop where judgment starts.
Stack
- Models
- OpenAIClaudeOpen-source LLMs
- Agent tooling
- LangGraphModel Context ProtocolPython
- Data sources
- SplunkIBM QRadarCrowdStrikeMicrosoft DefenderSentinelOne
- Cases
- TheHiveServiceNowJira
How it works
- 1
Context
The agent receives the alert, the enrichment from the triage playbook and the runbook for that alert type, retrieved from the team's own documentation and closed cases.
- 2
Plan
It lists the questions to answer, for example whether the user signed in from this location before, or what else the host did in the last hour.
- 3
Query
Through MCP tools it runs read-only searches in Splunk or QRadar and pulls host and process data from the EDR. Each query and result is logged.
- 4
Conclude
It writes a short summary, a timeline, a proposed verdict and the evidence behind it, and says what it could not verify.
- 5
Decide
The analyst accepts, edits or rejects the verdict. Response actions such as isolation or account disablement stay behind an approval step.
- 6
Measure
Accepted and rejected verdicts feed an evaluation set. It is used to score the agent before any prompt or model change goes live.
Guardrails and failure handling
- Investigation tools are read-only. Any action that changes a system needs a human approval recorded in the case.
- The agent sees only the data the analyst could see, and secrets never enter a prompt.
- Alert fields are passed to the model as data, never as instructions, and tool scopes are narrow, which limits what a prompt injection hidden in an alert can reach.
- Every prompt, tool call and answer is logged for audit and replay.
- A fixed evaluation set compares agent verdicts with analyst verdicts. A model or prompt change ships only if it holds up on that set.
- Each alert has a step and cost limit, and a failure leaves the alert in the normal queue.
What changes for the SOC
- Analysts review a prepared investigation instead of starting one.
- Verdict quality is measured against analyst decisions.
- Cost and accuracy per alert type are visible, so the team decides where the agent is allowed to run.