AutoTriage: Autonomous SOC Agent

An autonomous AI agent that reduces forensic triage from hours to seconds by automatically detecting, analyzing, and quarantining threats.

Comment

The Inspiration: Machine Speed vs. Human Speed

In modern cybersecurity, lateral movement by malware happens in minutes, but the average Security Operations Center (SOC) takes hours to manually triage system alerts. We realized that using AI simply to "summarize alerts" on a dashboard wasn't enough. We needed a system that fights back. We built the Auto Triage Agent to eliminate human latency by completely automating the forensic analysis and containment lifecycle.

What it does

Our agent is a fully autonomous defense mechanism. It monitors live system telemetry (CPU, Network, Registry) and instantly identifies malicious patterns. Instead of just sending an email to an admin, the agent autonomously generates a threat assessment, targets the specific malicious Process ID (PID), and executes OS-level countermeasures (like quarantine or firewall blocks) in under 5 seconds.

How we built it: The Two-Tiered Brain

We engineered a highly optimized pipeline to solve the biggest problem with LLMs: rate limits and latency.

  1. The Zero-Cost Filter (Machine Learning): We don't send raw logs to an LLM. We built a local anomaly detection engine using an Isolation Forest model from scikit-learn. The model evaluates the telemetry, calculating the anomaly score s of an observation x using the standard formulation: $$s(x, n) = 2^{-\frac{E(h(x))}{c(n)}}$$ If s is close to 1, it's flagged. This means we process thousands of logs locally for zero cost.
  2. The Autonomous Agent (LLM): Only when the ML model triggers a critical IOC (Indicator of Compromise) is the payload passed to our LangChain + Gemini 2.5 Agent. The LLM acts as the senior analyst, reading the data, identifying the specific threat (e.g., svchost_suspicious.exe), and triggering the Python execution functions to kill the process.
  3. The Backend: The entire system is orchestrated asynchronously using FastAPI, serving a custom-built, zero-dependency Tailwind CSS dashboard.

Challenges we ran into

  • API Rate Limiting: Initially, analyzing logs with the LLM caused severe bottlenecks. Building the local Machine Learning filter solved this entirely.
  • Autonomous Execution Privileges: Simulating real OS-level commands (like taskkill and netsh) required strict payload formatting. We had to heavily prompt-engineer the LangChain agent to output exact target PIDs so the backend functions wouldn't crash.

Accomplishments that we're proud of

We successfully moved beyond a "chat interface." We built an agent that takes action. Seeing the system autonomously identify a simulated malware spike, decide to kill it, and log the execution in the live terminal without a single human click was our biggest win.

What we learned

We learned that the most powerful AI applications don't use Large Language Models for everything. By combining traditional, lightweight ML for fast parsing with generative AI for complex decision-making, you get a system that is both incredibly smart and production-ready.

What's next for the Auto Triage Agent

  • Multi-Agent Swarms: Deploying specialized sub-agents (e.g., one for network analysis, one for memory dumps).
  • Cloud Integration: Connecting the execution layer to AWS IAM or Azure AD to automatically revoke compromised user credentials.

Built With

Share this project:

Updates

Submission history