ROOH 2.0 — Agentic AI SOC Reasoning Engine

An agentic AI SOC engine that thinks like a Tier-3 analyst, correlating alerts to reconstruct attack chains, assign confidence, and guide real-time incident response beyond traditional SIEMs.

Comment

Inspiration

Modern SOC teams are overwhelmed—not by a lack of alerts, but by a lack of reasoning. SIEMs generate thousands of signals, yet analysts still manually reconstruct attack chains, assess confidence, and decide whether an incident truly matters. ROOH 2.0 was inspired by a simple question: “What if alerts could explain themselves like a senior SOC analyst?” Instead of building another chatbot or log summarizer, we aimed to build an AI reasoning layer that sits on top of existing security tools and gives alerts context, intent, and decision clarity.

What it does

ROOH 2.0 is an Agentic AI SOC Reasoning Engine that analyzes raw security alerts and reconstructs complete cyber-attack narratives. It: Correlates alerts across identity, endpoint, and network signals Rebuilds the full attack chain step-by-step (MITRE ATT&CK aligned) Explains what happened, why it happened, and attacker intent Assigns a deterministic confidence score with justification Decides whether human SOC intervention is required Provides actionable remediation steps Highlights the exact control gap where the attack should have been stopped ROOH does not replace a SIEM — it gives alerts a soul.

How we built it

Built as a custom interactive app using Google AI Studio Powered by Gemini 3 Flash for fast, high-fidelity reasoning Designed a structured system prompt that enforces SOC-grade output (not chatbot behavior) Implemented an agentic flow where ROOH: Correlates events Evaluates confidence Makes escalation decisions UI designed for SOC realism: Attack timelines MITRE ATT&CK mapping Analyst operation panels ROOH Copilot for follow-up investigation Demonstrated with multiple real-world attack scenarios: Privileged account compromise Service account abuse LOLBin execution C2 beaconing & data access

Challenges we ran into:

Preventing the model from behaving like a generic chatbot Forcing consistent, deterministic SOC-style outputs Balancing confidence scoring without hallucination Designing prompts that scale across different attack scenarios Making the UI feel realistic enough for a SOC, not just a demo Accomplishments that we're proud of Built a working, shareable live app, not just a concept Achieved clear end-to-end attack reconstruction Successfully demonstrated agentic reasoning, not summarization Created a UI that judges can interact with in real time Delivered SOC-ready output suitable for incident review meetings

Accomplishments that we're proud of:

Built a working, publicly accessible interactive demo using the Gemini 3 API, not just slides or mockups. Successfully demonstrated end-to-end attack chain reconstruction from raw security alerts to a SOC-ready incident report. Implemented agentic reasoning that goes beyond summarization by correlating events, assigning confidence levels, and recommending analyst actions. Designed a realistic SOC-style UI with timelines, attack stages, intent analysis, and confidence scoring that judges can interact with live. Proved that prompt-driven reasoning with Gemini 3 can emulate Tier-3 SOC analyst decision-making in real-world incident scenarios.

What we learned

Prompt engineering can simulate expert reasoning, not just answers Structure + constraints matter more than raw model size Agentic flows dramatically improve clarity and trust Security teams value decision support, not more alerts Gemini excels when given long-context, reasoning-heavy tasks What's next for ROOH 2.0 — Agentic AI SOC Reasoning Engine Add multimodal analysis (screenshots, SIEM dashboards, log images) Introduce function-calling agents: Threat intel lookups IP reputation checks CVE correlation Interactive attack chain visualizations False-positive reasoning and alert suppression logic Integration with real SOC tools (SOAR, EDR, SIEM APIs)

What's next for ROOH 2.0 — Agentic AI SOC Reasoning Engine

Add multimodal reasoning by allowing analysts to upload screenshots of SIEM dashboards, log excerpts, and alert graphs for contextual analysis. Introduce function-calling agent workflows for: Threat intelligence lookups IP and domain reputation checks CVE and exploit correlation Implement false-positive reasoning and alert suppression, helping SOC teams focus only on incidents that truly require human intervention. Build interactive attack chain visualizations that dynamically update as new alerts are added. Integrate with real-world SOC tooling via APIs, including SIEM, EDR, and SOAR platforms, to enable closed-loop detection and response. Evolve ROOH into a persistent SOC copilot that learns from analyst feedback and improves confidence scoring over time. Long-term vision: Transform alert noise into clear reasoning, high-confidence decisions, and faster incident response for modern security teams.

Built With

Share this project:

Updates