SOC Alert Triage Agent with MITRE ATT&CK Mapping

Can a small local language model triage security alerts like a SOC analyst? This project builds a defensive alert-triage agent: a LangGraph supervisor sends each window of recorded Windows security events to a hunter agent (read-only log tools chosen by the LLM), an enricher agent (Sigma rule matching and TF-IDF retrieval over MITRE ATT&CK with id validation) and a reporter agent whose guardrail rejects uncited evidence and unknown technique ids; an analyst approves every escalation. It is compared with converted SigmaHQ rules and a single-shot LLM prompt on OTRF Security-Datasets atomic Windows recordings (one attack and one routine background window each). qwen2.5:3b was served by Ollama on a second laptop (RTX 2050 4 GB, 32 GB RAM) over Wi-Fi; the code ran on a laptop with RTX 2050 4 GB (Ryzen 7, 8 GB RAM).

NOTE: Defensive research demo: it analyses public, recorded lab event logs (OTRF Security-Datasets) only; every tool is read-only, nothing is executed on a live system, and the agent refuses offensive requests. An analyst approves every escalation.

Category: Department of Computer Science and Engineering / Agent Development

Agent Development Project AG12 from ProTechSC Academy, with graphical abstract, video demonstration and project guidance.