AgentSOC - A Multi-Layer Agentic AI Framework for Security Operations Automation

Oct 21, 2026

Security Operations Centers (SOCs) face persistent challenges in correlating heterogeneous alerts, interpreting multi-stage attack progressions, and choosing response actions that remain both safe and effective. AgentSOC proposes a multi-layer agentic AI framework that unifies perception, anticipatory reasoning, and risk-aware action planning in a single operational loop. The architecture normalizes alerts, enriches context, generates and validates hypotheses through structural feasibility checks, and executes policy-compliant responses. Evaluation in a large enterprise scenario shows improved triage consistency and safer containment options, with an additional minimal LANL-authentication POC supporting feasibility.

LanguageEnglish

CategoryResearch & Report

FormatPDF

Pages7

Reading Time18 min

AccessFree to download

Introduction

SOC Automation Challenges

Background and Related Work

Related Work Overview

AgentSOC: A Multi-Layer Agentic AI Framework for Security Operations Automation arXiv :2604 .20134v1 [ cs .CR] 22 Apr 2026 1st Joyjit Roy IEEE Member Austin, Texas, USA [joyjit.roy.tech@gmail.com](joyjit.roy.tech@gmail.com) Abstract—Security Operations Centers (SOCs) increasingly encounter difficulties in correlating heterogeneous alerts, interpreting multi-stage attack progressions, and selecting safe and effective response actions. This study introduces AgentSOC, a multi-layered agentic AI framework that enhances SOC automation by integrating perception, anticipatory reasoning, and riskbased action planning. The proposed architecture consolidates several layers of abstraction to provide a single operational loop to support normalizing alerts, enriching context, generating hypotheses, validating structural feasibility, and executing policycompliant responses. Conceptually evaluated within a large enterprise environment, AgentSOC improves triage consistency, anticipates attackers’ intentions, and provides recommended containment options that are both operationally feasible and wellbalanced between security efficacy and operational impact. The results suggest that hybrid agentic reasoning has the potential to serve as a foundation for developing adaptive, safer SOC automation in large enterprises. Additionally, a minimal ProofOf-Concept (POC) demonstration using LANL authentication data demonstrated the feasibility of the proposed architecture. Index Terms—Agentic AI, Security Operations Center, Threat Detection, MITRE ATT&CK, Counterfactual Reasoning, Structural Simulation I. INTRODUCTION Security Operations Centers (SOCs) encounter increasing complexity within contemporary enterprise environments. Analysts contend with high alert volumes, fragmented security tools, and continuously evolving attacker tactics. According to surveys, enterprise SOCs receive over 100,000 alerts per day [1] . As such, analysts spent between 2 and 4 hours on manual triage, with nearly 70% of these alerts being left without further investigation [2], [3] . This resulted in alert fatigue, inconsistent decisions, and delayed response. Existing SIEM, SOAR, and XDR platforms automate certain capabilities, but still rely significantly on human interpretation. These systems correlate events and initiate predefined workflows. However, analysts remain ultimately accountable for contextual decision-making and executing final response actions. Large Language Models (LLMs) have introduced advanced capabilities in summarization, contextual enrichment, and ruledriven automation [4] . However, most of these LLM solutions act as ”copilots”. They suggest actions but rely on human investigation. They also lack grounding in enterprise constraints and may recommend responses that are unsafe or infeasible within existing identity and network structures [1] . As a result, 979-8-3315-4970-1/26/$31.00 © 2026 IEEE 2nd Samaresh Kumar Singh IEEE Senior Member Leander, Texas, USA [ssam3003@gmail.com](ssam3003@gmail.com) creative generation and operational safety remain misaligned in current solutions. A significant gap persists. SOCs require autonomous reasoning capable of anticipating attacker movement, validating structural feasibility, and selecting response actions that safeguard business operations. Such autonomy must be explainable, risk-aware, and aligned with policy controls to avoid accidental disruption. Existing tools do not provide these capabilities. This paper presents AgentSOC, a multi-layer agentic AI framework designed for SOC environments. AgentSOC is intended to support autonomous decision-making with context awareness and safety alignment. The framework integrates perception, anticipatory reasoning, and risk-aware action planning within a unified operational loop. AgentSOC addresses the limitations of current SOC automation through three integrated mechanisms: 1) Narrative Counterfactual Engine (NCE): Generates multip

FAQs

What problems does AgentSOC target in SOC operations?

AgentSOC targets alert correlation across heterogeneous signals, understanding multi-stage attack progressions, and selecting safe, effective response actions under operational constraints.

How does AgentSOC generate and validate attack hypotheses?

It uses the Narrative Counterfactual Engine (NCE) to generate multiple attack hypotheses grounded in MITRE ATT&CK, then verifies feasibility with the Structural Simulation Engine (SSE) using enterprise topology and policy constraints.

How does AgentSOC choose defensive actions safely?

The Risk Scoring and Evaluation Module (RSEM) ranks candidate containment actions using composite scores that balance effectiveness, business impact, and execution cost.

Oct 21, 2026

Uploaded by Riley West