Autonomous Threat Triage and Investigation Agent

How the system actually runs.

Each stage below is a real component in the deployed pipeline. Stages outlined in teal are control points: the places where the architecture constrains what the model can receive or emit.

What it runs on.

How it is wired.

1. Hybrid deployment. Azure OpenAI and the LangGraph orchestration run in Azure; MISP, Splunk, and the CMDB stay on-premises in the SOC datacenter.
2. All cloud-to-on-premises traffic routes over Azure ExpressRoute. No path touches the public internet at any stage.
3. The LangGraph agent receives a normalized Splunk alert, determines the context it needs, and issues typed tool calls in sequence.
4. Tool call outputs are wrapped in typed schema objects carrying source labels, for example {source: "virustotal_api", data: {...}}, before being passed back into model context.
5. The final output is a structured triage report: confidence score, MITRE technique mapping, recommended disposition, and reasoning narrative.
6. A human-in-the-loop confirmation gate is required before any client-facing communication or ticket closure proceeds.

What keeps it inside its contract.

Guardrails were designed in from the start, not added after the fact. Where the system touches untrusted input, a control sits between that input and the model.

• All tool calls are logged to Azure Immutable Blob Storage before execution. The log is append-only and tamper-evident.
• The agent operates under strict least-privilege tool grants: read-only access to the SIEM and enrichment APIs, with no write path to firewall rules or client communications.
• Tool outputs wrapped in typed schema objects with source labels prevent raw external text from blending into the instruction context.
• Red-team testing specifically targeted alert content mimicking MISP intelligence reports, to test context confusion and disposition manipulation.
• The model system prompt explicitly instructs the agent to surface uncertainty rather than confabulate missing data.
• Human confirmation is required before any remediation or client-facing action. The agent cannot act unilaterally on any output.

What we still track.

No production AI system is finished. These are the live risks carried by this architecture, documented for the operating team rather than buried.

• Alert content crafted to resemble threat intelligence text could attempt to manipulate the agent's disposition recommendation.
• Tool call latency across the hybrid ExpressRoute path could delay time-sensitive investigations if circuit congestion occurs.
• Model hallucination risk on MITRE technique mapping for novel or ambiguous attack patterns with sparse evidence.
• Client data from hundreds of tenants transiting a shared orchestration layer requires strict logical isolation controls at the LangGraph level.

What changed.

• Tier 1 analysts offloaded the majority of deterministic false-positive closures, recovering hours of analyst capacity per shift.
• Mean time to human review on real escalations dropped significantly as enrichment and context gathering became automated.
• The immutable audit log provided a defensible chain of evidence for client-facing incident reports.
• The architecture demonstrated that a regulated MSSP can deploy agentic AI against multi-tenant client data without sacrificing least-privilege controls.

On numbers. Client identity and any identifying detail are withheld under NDA. Outcomes are stated as direction and materiality rather than as figures we are not free to publish.