AI / ML · Software Architecture
AI agents that investigate alerts and explain their verdict
An AI assistant reviews each security event, decides which checks to run — login history, IP reputation, a web search — and writes a plain-language verdict, alerting the team only when the risk is high.
Proof of concept: LLM-supervised multi-agent threat detection
Where this helps
- Reducing alert fatigue in operations and security teams
- Triaging large volumes of log events
- Prototyping agent-based automation in a controlled way
The rest of this page is the technical deep dive — how it was built and what its limits are.
The technical problem
Streams of security log events are too noisy for fixed rules alone, but sending everything to an analyst does not scale.
How the architecture works
- 01 · Stream
Log events are fed to the supervisor one at a time.
- 02 · Score
A rules table gives each event a heuristic risk score from 0 to 100.
- 03 · Investigate
The LLM conditionally calls SQL lookup, AbuseIPDB reputation or web search.
- 04 · Act
High-risk results trigger a Slack alert; every event gets a written summary.
What was being explored
Whether an LLM can act as an orchestrator that chooses investigation steps, rather than as a classifier — keeping the deterministic parts (rules, lookups) as ordinary tools.
Design decisions
Tools are plain Python callables registered with the supervisor, so new capabilities can be added without changing the graph. External calls are allowed to fail gracefully so that rate limits do not stop the pipeline.
Limitations and next steps
- A proof of concept with a seeded SQLite table, not a SIEM integration.
- Live AbuseIPDB and search calls are subject to free-tier rate limits.
- No persistence between runs; detection quality has not been benchmarked.
Related writing
From Logs to Decisions: An LLM-Driven Multi-Agent Pipeline for Cyber Threat Detection
A LangGraph supervisor that lets an LLM choose between heuristic scoring, database lookups, threat-intelligence and web-search tools to classify streamed log events and raise alerts.