mlsanityData to 14 Oct 2026

Towards Agentic Investigation of Security Alerts

arXiv 2604.25846 ↗First posted 28 Apr 2026cs.CR cs.AIcited by 1

On the map: LLM agents and tool use → Agent threats, guardrails and governance

Abstract (arXiv)

Security analysts are overwhelmed by the volume of alerts and the low context provided by many detection systems. Early-stage investigations typically require manual correlation across multiple log sources, a task that is usually time-consuming. In this paper, we present an experimental, agentic workflow that leverages large language models (LLMs) augmented with predefined queries and constrained tool access (structured SQL over Suricata logs and grep-based text search) to automate the first stages of alert investigation. The proposed workflow integrates queries to provide an overview of the available data, and LLM components that selects which queries to use based on the overview results, extracts raw evidence from the query results, and delivers a final verdict of the alert. Our results demonstrate that the LLM-powered workflow can investigate log sources, plan an investigation, and produce a final verdict that has a significantly higher accuracy than a verdict produced by the same LLM without the proposed workflow. By recognizing the inherent limitations of directly applying LLMs to high-volume and unstructured data, we propose combining existing investigation practices of real-world analysts with a structured approach to leverage LLMs as virtual security analysts, thereby assisting and reducing the manual workload.

Key facts. Cited by 1 paper in the map (data through 14 Oct 2026). Placed in Agent threats, guardrails and governance, one of 16 directions in LLM agents and tool use. Builds on 5 of its 25 references that are in the map. First posted on arXiv 28 Apr 2026.

Builds on

5 of 25 references.

References · 5

  1. 2023Toolformer: Language Models Can Teach Themselves to Use Toolscited by 4,182
  2. 2023AutoGen: Enabling Next-Gen LLM Applications via Multi-Agent Conversationcited by 1,988
  3. 2025A Survey of Context Engineering for Large Language Modelscited by 126
  4. 2023ChatGPT Prompt Patterns for Improving Code Quality, Refactoring, Requirements Elicitation, and Software Designcited by 66
  5. 2023Benchmarking Large Language Models for Log Analysis, Security, and Interpretationcited by 19

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2026: 1.

1 paper.

  1. 2026GenAI-Driven Threat Detection with Microsoft Security Copilotcited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2026From Investigation Failures to Reliable SOC Agents: Understanding and Improving LLM-Based Alert Triage
  2. 2025ExCyTIn-Bench: Evaluating LLM agents on Cyber Threat Investigation
  3. 2025CORTEX: Collaborative LLM Agents for High-Stakes Alert Triage
  4. 2026Before You Hand Over the Wheel: Evaluating LLMs for Security Incident Analysis
  5. 2026Toward Autonomous SOC Operations: End-to-End LLM Framework for Threat Detection, Query Generation, and Resolution in Security Operations
  6. 2025CyberRAG: An Agentic RAG cyber attack classification and reporting tool
  7. 2026Retrieval-Augmented LLMs for Security Incident Analysis
  8. 2026When LLMs Team Up: A Coordinated Attack Framework for Automated Cyber Intrusions