File size: 1,973 Bytes
5cc4b50 | 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 | # Agentic SOC: Autonomous Security Operations Center
Research & architecture design document for building a fully autonomous Security Operations Center powered by LLM-based reasoning agents.
**Start here:** [Full Research Document](./agentic-soc-research.md)
## Key Highlights
- **Core Innovation:** Store the *model*, not the *data*. Normal logs update the baseline and are discarded. Only anomaly logs are retained. ~70% cost reduction vs traditional SIEMs.
- **Architecture:** 7-layer pipeline from CloudTrail ingestion → statistical baselining → multi-agent LLM triage → automated remediation
- **Three-Way Verdict:** Every alert ends in one of: False Positive (dismiss), True Positive + Auto-Remediate (act), True Positive + Escalate (human)
- **Grounded in Research:** Based on 15+ papers including CORTEX (arxiv:2510.00311), AACT (arxiv:2505.09843), CloudAnoAgent (arxiv:2508.01844)
## Architecture Overview
```
CloudTrail Events → Feature Extraction → Baseline Accumulator (no raw storage)
│
anomaly detected
│
Multi-Agent LLM Triage
(Orchestrator → Behavior Analysis →
Evidence Gathering → Reasoning)
│
┌────────────────┼────────────────┐
FALSE POS AUTO-ACT ESCALATE
(dismiss) (remediate) (human)
```
## Files
- `agentic-soc-research.md` — Full research document (15 sections, ~1500 lines)
- Covers: architecture, baseline algorithms, multi-agent pipeline, MITRE ATT&CK mappings, storage economics, implementation roadmap, code examples, and 20+ paper references
|