SENTINEL‑RL for SOCs: Architectural Gains and Cost Realities from Decoupling Semantic and Topological Reasoning

Description and use

SENTINEL‑RL decouples semantic annotation from topological policy in SOC pipelines, boosting throughput and reducing engineering effort while keeping compute linear.

Problem

Legacy SOC platforms entangle semantic reasoning and graph traversal, causing throughput bottlenecks, high human effort, and runaway costs in large‑scale authentication investigations.

Outcome

SENTINEL‑RL increased throughput from 4.7 to 18.2 graphs/minute, reduced engineering interventions from 3.2 to 0.7, and lowered CPU hours from 8.5 to 2.1, at the cost of modest LLM API spend (≈$17.35/run).

Workflow

• 1. Ingest raw authentication events.
• 2. SemanticAgent annotates each event using an embedding model, producing a suspicious flag per node.
• 3. TopologyAgent receives only semantic tags and applies an RL or heuristic policy to select action nodes based on graph degree.
• 4. Message bus passes lightweight annotations between pipelines.
• 5. Actions are executed or escalated to human analysts.

Evidence

Legacy SOAR GPU Hours 0, CPU‑Hours 8.5, Mean Engr. Interventions 3.2, Graphs/Minute 4.7; SENTINEL‑RL GPU Hours 0.12, CPU‑Hours 2.1, Mean Engr. Interventions 0.7, Graphs/Minute 18.2

Source

[2024-06-11T14:52:22.561Z][INFO] Initiating subgraph walk for alert_id=a7f... [2024-06-11T14:52:22.880Z][WARN] Context reload triggered at depth=7, edge=(host_9,host_18)

Source