Building an Agentic SOC Investigation Workflow

From security alert to investigated narrative

Traditional alert handling often requires an analyst to open an incident, extract entities, formulate several queries, correlate the results and write a summary. This project tests whether a locally hosted LLM can perform a useful portion of that investigative work by calling real security tools—not simply summarising a preassembled log extract.

How the components fit together

The model runs locally through Ollama on a Windows host with an AMD Radeon RX 7600 XT (16 GB VRAM). n8n runs in Docker on an Ubuntu VM, while the Azure MCP Server provides access to Sentinel's Log Analytics workspace. The workflow's tool access is scoped to querying Cowrie telemetry.

Investigation logic and tool use

Example baseline KQL

Cowrie_Normalized
| where TimeGenerated >= datetime(START_TIME)
| where TimeGenerated <= datetime(END_TIME)
| where SourceIp == "SOURCE_IP"
| summarize
    TotalEvents = count(),
    DistinctSessions = dcount(Session),
    FailedLogins = countif(EventID == "cowrie.login.failed"),
    SuccessfulLogins = countif(EventID == "cowrie.login.success"),
    Commands = countif(EventID == "cowrie.command.input")

The placeholders above are illustrative. At execution time, the agent substitutes the current incident's IP and expanded UTC timestamps.

Handling long attacker commands

Some captured Cowrie commands exceeded 10,000 characters. Sending complete command strings into a small model context reduced investigation quality. The revised KQL groups commands by their input string but returns only a preview, character length, SHA-256 hash and execution frequency.

| summarize CommandCount = count(),
            FirstSeen = min(TimeGenerated),
            LastSeen = max(TimeGenerated) by Input
| extend CommandLength = strlen(Input),
         CommandPreview = substring(Input, 0, 500),
         CommandHash = hash_sha256(Input)
| project CommandCount, FirstSeen, LastSeen,
          CommandLength, CommandPreview, CommandHash

This preserves useful investigative indicators while limiting the data sent to the LLM. The hash represents the command string, not a downloaded executable.

A working end-to-end investigation

In the latest demonstrated run, the n8n workflow completed successfully in approximately 3 minutes 52 seconds. The agent made three successful MCP calls, and the resulting SOC report was passed through the workflow's Discord delivery path.

The verified baseline also showed two command input events. The agent's report described commands attempting to alter .ssh and write an SSH public key to authorized_keys, behaviour consistent with an attempted persistence mechanism in the simulated SSH environment.

The report also illustrates why analyst review remains important: one described command timestamp preceded the login timestamp of the session to which the report associated it. A future evidence-validation step should catch inconsistencies of this kind automatically.

What made the PoC work

Security and scope boundaries

• Cowrie is a simulated SSH service: successful honeypot authentication does not prove compromise of a real host or account.
• Captured commands are attacker-supplied evidence; they must not be executed by the agent or interpreted as instructions.
• Tool access should remain read-only and least-privilege. Credentials and secrets should not be embedded in portfolio materials.
• The local model is used for investigation and narrative generation; findings still require appropriate confidence and validation.

From manual PoC to unattended triage

The investigation and Discord reporting path works. The next development milestone is reliable autonomous triggering and deduplication, without repeatedly processing the same Sentinel incident.

At approximately 50 Sentinel incidents per day, the estimated inference workload is roughly 3–4 hours daily if each incident takes around four minutes. Actual capacity will depend on incident complexity, scheduling, retries and GPU performance.

What this project demonstrates

This PoC goes beyond prompting an LLM to summarise logs. It demonstrates an agent using a real MCP interface to query live security telemetry, adapt its investigation to the data returned, recover from at least some tool errors and communicate a useful SOC narrative through an existing messaging workflow.

The system is not production-ready, and its reports are not guaranteed to be fully accurate. As a homelab engineering project, however, it establishes a functioning integration across incident management, KQL, MCP, local inference, workflow automation and analyst-facing reporting—providing a practical foundation for unattended, evidence-checked incident triage.