[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"doc-seo-628680-105":3,"detail-sidebar-cat-0-en-105":80,"doc-detail-628680-en":130},{"code":4,"msg":5,"data":6},0,"ok",{"site_id":7,"language":8,"slug":9,"title":10,"keywords":11,"description":12,"schema_data":13,"social_meta":73,"head_meta":75,"extra_data":77,"updated_unix":79},105,"en","agentsoc-a-multi-layer-agentic-ai-framework-for-security-operations-automation","AgentSOC - A Multi-Layer Agentic AI Framework for Security Operations Automation","","Security Operations Centers (SOCs) face persistent challenges in correlating heterogeneous alerts, interpreting multi-stage attack progressions, and choosing response actions that remain both safe and effective. AgentSOC proposes a multi-layer agentic AI framework that unifies perception, anticipatory reasoning, and risk-aware action planning in a single operational loop. The architecture normalizes alerts, enriches context, generates and validates hypotheses through structural feasibility checks, and executes policy-compliant responses. Evaluation in a large enterprise scenario shows improved triage consistency and safer containment options, with an additional minimal LANL-authentication POC supporting feasibility.",{"@graph":14,"@context":72},[15,34,55],{"@type":16,"itemListElement":17},"BreadcrumbList",[18,23,27,31],{"item":19,"name":20,"@type":21,"position":22},"https://docshare.wps.com","Home","ListItem",1,{"item":24,"name":25,"@type":21,"position":26},"https://docshare.wps.com/document/","Document",2,{"item":28,"name":29,"@type":21,"position":30},"https://docshare.wps.com/document/research-report/","Research & Report",3,{"item":32,"name":10,"@type":21,"position":33},"https://docshare.wps.com/document/agentsoc-a-multi-layer-agentic-ai-framework-for-security-operations-automation/628680/",4,{"url":32,"name":10,"@type":35,"image":36,"author":41,"headline":10,"publisher":44,"fileFormat":47,"inLanguage":8,"description":12,"dateModified":48,"datePublished":49,"encodingFormat":47,"isAccessibleForFree":50,"interactionStatistic":51},"DigitalDocument",{"url":37,"@type":38,"width":39,"height":40},"https://docshare.wps.com/thumbnails/agentsoc-a-multi-layer-agentic-ai-framework-for-security-operations-automation/628680.png","ImageObject",300,407,{"name":42,"@type":43},"Riley West","Person",{"url":19,"name":45,"@type":46},"DocShare","Organization","application/pdf","2026-10-30","2026-10-21",true,{"@type":52,"interactionType":53,"userInteractionCount":33},"InteractionCounter",{"@type":54},"ViewAction",{"@type":56,"mainEntity":57},"FAQPage",[58,64,68],{"name":59,"@type":60,"acceptedAnswer":61},"What problems does AgentSOC target in SOC operations?","Question",{"text":62,"@type":63},"AgentSOC targets alert correlation across heterogeneous signals, understanding multi-stage attack progressions, and selecting safe, effective response actions under operational constraints.","Answer",{"name":65,"@type":60,"acceptedAnswer":66},"How does AgentSOC generate and validate attack hypotheses?",{"text":67,"@type":63},"It uses the Narrative Counterfactual Engine (NCE) to generate multiple attack hypotheses grounded in MITRE ATT&CK, then verifies feasibility with the Structural Simulation Engine (SSE) using enterprise topology and policy constraints.",{"name":69,"@type":60,"acceptedAnswer":70},"How does AgentSOC choose defensive actions safely?",{"text":71,"@type":63},"The Risk Scoring and Evaluation Module (RSEM) ranks candidate containment actions using composite scores that balance effectiveness, business impact, and execution cost.","https://schema.org",{"og:url":32,"og:type":74,"og:title":10,"og:site_name":45,"og:description":12},"article",{"robots":76,"canonical":32},"index,follow",{"doc_id":78,"site_id":7},628680,1793122787,{"code":4,"msg":81,"data":82},"success",[83,87,91,95,100,105,110,114,119,122,126],{"id":22,"doc_module":4,"doc_module_name":25,"category_name":84,"show_sort_weight":85,"slug":86},"Story & Novel",90,"story-novel",{"id":26,"doc_module":4,"doc_module_name":25,"category_name":88,"show_sort_weight":89,"slug":90},"Literature",80,"literature",{"id":33,"doc_module":4,"doc_module_name":25,"category_name":92,"show_sort_weight":93,"slug":94},"Exam",70,"exam",{"id":96,"doc_module":4,"doc_module_name":25,"category_name":97,"show_sort_weight":98,"slug":99},5,"Comic",60,"comic",{"id":101,"doc_module":4,"doc_module_name":25,"category_name":102,"show_sort_weight":103,"slug":104},6,"Technology",50,"technology",{"id":106,"doc_module":4,"doc_module_name":25,"category_name":107,"show_sort_weight":108,"slug":109},7,"Healthcare",40,"healthcare",{"id":111,"doc_module":4,"doc_module_name":25,"category_name":29,"show_sort_weight":112,"slug":113},8,30,"research-report",{"id":115,"doc_module":4,"doc_module_name":25,"category_name":116,"show_sort_weight":117,"slug":118},9,"Religion & Spirituality",20,"religion-spirituality",{"id":117,"doc_module":4,"doc_module_name":25,"category_name":120,"show_sort_weight":117,"slug":121},"World Cup","world-cup",{"id":123,"doc_module":4,"doc_module_name":25,"category_name":124,"show_sort_weight":123,"slug":125},10,"Lifestyle","lifestyle",{"id":127,"doc_module":4,"doc_module_name":25,"category_name":128,"show_sort_weight":96,"slug":129},19,"General","general",{"code":4,"msg":81,"data":131},{"doc_id":78,"user_id":132,"nickname":42,"user_avatar":133,"doc_module":4,"category_id":111,"category_name":29,"doc_title":10,"doc_description":12,"doc_content":134,"file_id":135,"file_url":136,"file_type":137,"file_size":138,"view_count":33,"is_deleted":4,"is_public":22,"is_downloadable":22,"audit_status":22,"page_count":106,"language":139,"language_code":8,"site_id":7,"html_lang":8,"table_of_contents":140,"faqs":141,"seo_title":142,"seo_description":12,"update_tm":143,"read_time":144},1099523885074,"https://ap-avatar.wpscdn.com/davatar_9964176cb1d06d4a9deccf72a44ae3dc","AgentSOC: A Multi-Layer Agentic AI Framework for Security Operations Automation  \narXiv :2604 .20134v1 [ cs .CR] 22 Apr 2026  \n1st Joyjit Roy  \nIEEE Member  \nAustin, Texas, USA [joyjit.roy.tech@gmail.com](joyjit.roy.tech@gmail.com)  \nAbstract—Security Operations Centers (SOCs) increasingly encounter difficulties in correlating heterogeneous alerts, interpreting multi-stage attack progressions, and selecting safe and effective response actions. This study introduces AgentSOC, a multi-layered agentic AI framework that enhances SOC automation by integrating perception, anticipatory reasoning, and riskbased action planning. The proposed architecture consolidates several layers of abstraction to provide a single operational loop to support normalizing alerts, enriching context, generating hypotheses, validating structural feasibility, and executing policycompliant responses. Conceptually evaluated within a large enterprise environment, AgentSOC improves triage consistency, anticipates attackers’ intentions, and provides recommended containment options that are both operationally feasible and wellbalanced between security efficacy and operational impact. The results suggest that hybrid agentic reasoning has the potential to serve as a foundation for developing adaptive, safer SOC automation in large enterprises. Additionally, a minimal ProofOf-Concept (POC) demonstration using LANL authentication data demonstrated the feasibility of the proposed architecture.  \nIndex Terms—Agentic AI, Security Operations Center, Threat Detection, MITRE ATT&CK, Counterfactual Reasoning, Structural Simulation  \nI. INTRODUCTION  \nSecurity Operations Centers (SOCs) encounter increasing complexity within contemporary enterprise environments. Analysts contend with high alert volumes, fragmented security tools, and continuously evolving attacker tactics. According to surveys, enterprise SOCs receive over 100,000 alerts per day [1] . As such, analysts spent between 2 and 4 hours on manual triage, with nearly 70% of these alerts being left without further investigation [2], [3] . This resulted in alert fatigue, inconsistent decisions, and delayed response.  \nExisting SIEM, SOAR, and XDR platforms automate certain capabilities, but still rely significantly on human interpretation. These systems correlate events and initiate predefined workflows. However, analysts remain ultimately accountable for contextual decision-making and executing final response actions.  \nLarge Language Models (LLMs) have introduced advanced capabilities in summarization, contextual enrichment, and ruledriven automation [4] . However, most of these LLM solutions act as ”copilots”. They suggest actions but rely on human investigation. They also lack grounding in enterprise constraints and may recommend responses that are unsafe or infeasible within existing identity and network structures [1] . As a result,  \n979-8-3315-4970-1/26/$31.00 © 2026 IEEE  \n2nd Samaresh Kumar Singh  \nIEEE Senior Member  \nLeander, Texas, USA  \n[ssam3003@gmail.com](ssam3003@gmail.com)  \ncreative generation and operational safety remain misaligned in current solutions.  \nA significant gap persists. SOCs require autonomous reasoning capable of anticipating attacker movement, validating structural feasibility, and selecting response actions that safeguard business operations. Such autonomy must be explainable, risk-aware, and aligned with policy controls to avoid accidental disruption. Existing tools do not provide these capabilities.  \nThis paper presents AgentSOC, a multi-layer agentic AI framework designed for SOC environments. AgentSOC is intended to support autonomous decision-making with context awareness and safety alignment. The framework integrates perception, anticipatory reasoning, and risk-aware action planning within a unified operational loop.  \nAgentSOC addresses the limitations of current SOC automation through three integrated mechanisms:  \n1) Narrative Counterfactual Engine (NCE): Generates multip","cbCaiboNNVTTmgVN","https://ap.wps.com/l/cbCaiboNNVTTmgVN","pdf",651818,"English","# Introduction\n## SOC Automation Challenges\n# Background and Related Work\n## Related Work Overview","[{\"question\":\"What problems does AgentSOC target in SOC operations?\",\"answer\":\"AgentSOC targets alert correlation across heterogeneous signals, understanding multi-stage attack progressions, and selecting safe, effective response actions under operational constraints.\"},{\"question\":\"How does AgentSOC generate and validate attack hypotheses?\",\"answer\":\"It uses the Narrative Counterfactual Engine (NCE) to generate multiple attack hypotheses grounded in MITRE ATT\\u0026CK, then verifies feasibility with the Structural Simulation Engine (SSE) using enterprise topology and policy constraints.\"},{\"question\":\"How does AgentSOC choose defensive actions safely?\",\"answer\":\"The Risk Scoring and Evaluation Module (RSEM) ranks candidate containment actions using composite scores that balance effectiveness, business impact, and execution cost.\"}]","AgentSOC - A Multi-Layer Agentic AI Framework for Security Operations Automation | PDF",1792617873,18]