# Agentic SOC: Autonomous Security Operations Center

Research & architecture design document for building a fully autonomous Security Operations Center powered by LLM-based reasoning agents.

**Start here:** [Full Research Document](./agentic-soc-research.md)

## Key Highlights

- **Core Innovation:** Store the *model*, not the *data*. Normal logs update the baseline and are discarded. Only anomaly logs are retained. ~70% cost reduction vs traditional SIEMs.
- **Architecture:** 7-layer pipeline from CloudTrail ingestion → statistical baselining → multi-agent LLM triage → automated remediation
- **Three-Way Verdict:** Every alert ends in one of: False Positive (dismiss), True Positive + Auto-Remediate (act), True Positive + Escalate (human)
- **Grounded in Research:** Based on 15+ papers including CORTEX (arxiv:2510.00311), AACT (arxiv:2505.09843), CloudAnoAgent (arxiv:2508.01844)

## Architecture Overview

```
CloudTrail Events → Feature Extraction → Baseline Accumulator (no raw storage)
                                              │
                                         anomaly detected
                                              │
                                    Multi-Agent LLM Triage
                                    (Orchestrator → Behavior Analysis →
                                     Evidence Gathering → Reasoning)
                                              │
                              ┌────────────────┼────────────────┐
                         FALSE POS         AUTO-ACT          ESCALATE
                         (dismiss)       (remediate)         (human)
```

## Files

- `agentic-soc-research.md` — Full research document (15 sections, ~1500 lines)
- Covers: architecture, baseline algorithms, multi-agent pipeline, MITRE ATT&CK mappings, storage economics, implementation roadmap, code examples, and 20+ paper references