AI agents that investigate alerts and explain their verdict
An AI assistant reviews each security event, decides which checks to run — login history, IP reputation, a web search — and writes a plain-language verdict, alerting the team only when the risk is high.
Useful for
- Reducing alert fatigue in operations and security teams
- Triaging large volumes of log events
- Prototyping agent-based automation in a controlled way
Technical details
LLM-supervised multi-agent threat detection
Problem
Streams of security log events are too noisy for fixed rules alone, but sending everything to an analyst does not scale.
Approach
A LangGraph supervisor lets an LLM decide which tools to call for each event — heuristic scoring, a SQL lookup of recent logins, IP reputation, web search — and produce a plain-English verdict, alerting Slack when risk is high.
- LangGraph
- OpenAI API
- SQLite
- AbuseIPDB
- Slack webhooks
- Python


