Towards Agentic Investigation of Security Alerts
Even Eilertsen, Vasileios Mavroeidis, Gudmund Grov
TLDR
This paper introduces an LLM-powered agentic workflow that automates early-stage security alert investigations, improving accuracy over direct LLM use.
Key contributions
- Introduces an agentic LLM workflow to automate early-stage security alert investigations.
- Augments LLMs with predefined queries and constrained tool access (SQL, grep) for log analysis.
- LLM components select queries, extract evidence, and provide accurate alert verdicts.
- Demonstrates significantly higher verdict accuracy than direct LLM application.
Why it matters
Security analysts are overwhelmed by alerts, requiring time-consuming manual investigations. This paper offers an LLM-powered workflow that automates early-stage alert investigations, reducing manual workload and improving verdict accuracy. It provides a structured method to leverage LLMs as virtual security analysts.
Original Abstract
Security analysts are overwhelmed by the volume of alerts and the low context provided by many detection systems. Early-stage investigations typically require manual correlation across multiple log sources, a task that is usually time-consuming. In this paper, we present an experimental, agentic workflow that leverages large language models (LLMs) augmented with predefined queries and constrained tool access (structured SQL over Suricata logs and grep-based text search) to automate the first stages of alert investigation. The proposed workflow integrates queries to provide an overview of the available data, and LLM components that selects which queries to use based on the overview results, extracts raw evidence from the query results, and delivers a final verdict of the alert. Our results demonstrate that the LLM-powered workflow can investigate log sources, plan an investigation, and produce a final verdict that has a significantly higher accuracy than a verdict produced by the same LLM without the proposed workflow. By recognizing the inherent limitations of directly applying LLMs to high-volume and unstructured data, we propose combining existing investigation practices of real-world analysts with a structured approach to leverage LLMs as virtual security analysts, thereby assisting and reducing the manual workload.
📬 Weekly AI Paper Digest
Get the top 10 AI/ML arXiv papers from the week — summarized, scored, and delivered to your inbox every Monday.