Towards Agentic Investigation of Security Alerts

• URL: http://arxiv.org/abs/2604.25846v1
• Date: Tue, 28 Apr 2026 16:52:12 GMT
• Title: Towards Agentic Investigation of Security Alerts
• Abstract summary: Security analysts are overwhelmed by the volume of alerts and the low context provided by detection systems.<n>Early-stage investigations typically require manual correlation across multiple log sources.<n>We present an experimental, agentic workflow that leverages large language models (LLMs) augmented with predefined queries.
• Score: 0.07646713951724012
• License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/
• Abstract: Security analysts are overwhelmed by the volume of alerts and the low context provided by many detection systems. Early-stage investigations typically require manual correlation across multiple log sources, a task that is usually time-consuming. In this paper, we present an experimental, agentic workflow that leverages large language models (LLMs) augmented with predefined queries and constrained tool access (structured SQL over Suricata logs and grep-based text search) to automate the first stages of alert investigation. The proposed workflow integrates queries to provide an overview of the available data, and LLM components that selects which queries to use based on the overview results, extracts raw evidence from the query results, and delivers a final verdict of the alert. Our results demonstrate that the LLM-powered workflow can investigate log sources, plan an investigation, and produce a final verdict that has a significantly higher accuracy than a verdict produced by the same LLM without the proposed workflow. By recognizing the inherent limitations of directly applying LLMs to high-volume and unstructured data, we propose combining existing investigation practices of real-world analysts with a structured approach to leverage LLMs as virtual security analysts, thereby assisting and reducing the manual workload.

Related papers

• Parser-Free Querying of Security Logs [2.9970870516340504]
  Security analysts routinely query system logs to detect threats and investigate incidents.<n>Each log source uses its own semi-structured format: logs are cheap to produce, but expensive to use.<n>We present Sieve, a system that generates executable query code from natural-language security questions.
  arXiv  Detail & Related papers  (2026-05-21T05:58:04Z)
• Can LLMs Clean Up Your Mess? A Survey of Application-Ready Data Preparation with LLMs [66.63911043019294]
  Data preparation aims to denoise raw datasets, uncover cross-dataset relationships, and extract valuable insights from them.<n>This paper focuses on the use of LLM techniques to prepare data for diverse downstream tasks.<n>We introduce a task-centric taxonomy that organizes the field into three major tasks: data cleaning, standardization, error processing, imputation, data integration, and data enrichment.
  arXiv  Detail & Related papers  (2026-01-22T12:02:45Z)
• LongDA: Benchmarking LLM Agents for Long-Document Data Analysis [55.32211515932351]
  LongDA targets real-world settings in which navigating long documentation and complex data is the primary bottleneck.<n>LongTA is a tool-augmented agent framework that enables document access, retrieval, and code execution.<n>Our experiments reveal substantial performance gaps even among state-of-the-art models.
  arXiv  Detail & Related papers  (2026-01-05T23:23:16Z)
• LAFA: Agentic LLM-Driven Federated Analytics over Decentralized Data Sources [35.235993431071286]
  Large Language Models (LLMs) have shown great promise in automating data analytics tasks by interpreting natural language queries.<n>Existing LLM-agent-based analytics frameworks operate under the assumption of centralized data access, offering little to no privacy protection.<n>We present LAFA, the first system that integrates LLM-agent-based data analytics with federated analytics.
  arXiv  Detail & Related papers  (2025-10-21T09:56:25Z)
• CORTEX: Collaborative LLM Agents for High-Stakes Alert Triage [10.088447487211893]
  Security Operations Centers (SOCs) are overwhelmed by tens of thousands of daily alerts.<n>This overload creates alert fatigue, leading to overlooked threats and analyst burnout.<n>We propose CORTEX, a multi-agent LLM architecture for high-stakes alert triage.
  arXiv  Detail & Related papers  (2025-09-30T22:09:31Z)
• Iterative Self-Incentivization Empowers Large Language Models as Agentic Searchers [74.17516978246152]
  Large language models (LLMs) have been widely integrated into information retrieval to advance traditional techniques.<n>We propose EXSEARCH, an agentic search framework, where the LLM learns to retrieve useful information as the reasoning unfolds.<n>Experiments on four knowledge-intensive benchmarks show that EXSEARCH substantially outperforms baselines.
  arXiv  Detail & Related papers  (2025-05-26T15:27:55Z)
• IDA-Bench: Evaluating LLMs on Interactive Guided Data Analysis [60.32962597618861]
  IDA-Bench is a novel benchmark evaluating large language models in multi-round interactive scenarios.<n>Agent performance is judged by comparing its final numerical output to the human-derived baseline.<n>Even state-of-the-art coding agents (like Claude-3.7-thinking) succeed on 50% of the tasks, highlighting limitations not evident in single-turn tests.
  arXiv  Detail & Related papers  (2025-05-23T09:37:52Z)
• Unleashing the Power of LLMs in Dense Retrieval with Query Likelihood Modeling [69.84963245729826]
  We propose an auxiliary task of QL to enhance the backbone for subsequent contrastive learning of the retriever.<n>We introduce our model, which incorporates two key components: Attention Block (AB) and Document Corruption (DC)
  arXiv  Detail & Related papers  (2025-04-07T16:03:59Z)
• System Log Parsing with Large Language Models: A Review [2.2779174914142346]
  Large language models (LLMs) have introduced the new research field of LLM-based log parsing.<n>Despite promising results, there is no structured overview of the approaches in this relatively new research field.<n>This work systematically reviews 29 LLM-based log parsing methods.
  arXiv  Detail & Related papers  (2025-04-07T09:41:04Z)
• To Err Is Human; To Annotate, SILICON? Reducing Measurement Error in LLM Annotation [11.470318058523466]
  Large Language Models (LLMs) promise a cost-effective scalable alternative to human annotation.<n>We develop the SILICON methodology to systematically reduce measurement error from LLM annotation.<n>Our evidence indicates that reducing each error source is necessary, and that SILICON supports rigorous annotation in management research.
  arXiv  Detail & Related papers  (2024-12-19T02:21:41Z)
• Get my drift? Catching LLM Task Drift with Activation Deltas [55.75645403965326]
  Task drift allows attackers to exfiltrate data or influence the LLM's output for other users.<n>We show that a simple linear classifier can detect drift with near-perfect ROC AUC on an out-of-distribution test set.<n>We observe that this approach generalizes surprisingly well to unseen task domains, such as prompt injections, jailbreaks, and malicious instructions.
  arXiv  Detail & Related papers  (2024-06-02T16:53:21Z)
• AuditLLM: A Tool for Auditing Large Language Models Using Multiprobe Approach [8.646131951484696]
  AuditLLM is a novel tool designed to audit the performance of various Large Language Models (LLMs) in a methodical way. A robust, reliable, and consistent LLM is expected to generate semantically similar responses to variably phrased versions of the same question. A certain level of inconsistency has been shown to be an indicator of potential bias, hallucinations, and other issues.
  arXiv  Detail & Related papers  (2024-02-14T17:31:04Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.