SENTINEL‑RL for SOCs: Architectural Gains and Cost Realities from Decoupling Semantic and Topological Reasoning

Описание и применение

SENTINEL‑RL разделяет семантическую и топологическую обработку событий в SOC, повышая пропускную способность и снижая затраты на инженеров.

Задача

Legacy SOC platforms entangle semantic reasoning and graph traversal, causing throughput bottlenecks, high human effort, and runaway costs in large‑scale authentication investigations.

Результат

SENTINEL‑RL increased throughput from 4.7 to 18.2 graphs/minute, reduced engineering interventions from 3.2 to 0.7, and lowered CPU hours from 8.5 to 2.1, at the cost of modest LLM API spend (≈$17.35/run).

Рабочий процесс

• 1. Ingest raw authentication events.
• 2. SemanticAgent annotates each event using an embedding model, producing a suspicious flag per node.
• 3. TopologyAgent receives only semantic tags and applies an RL or heuristic policy to select action nodes based on graph degree.
• 4. Message bus passes lightweight annotations between pipelines.
• 5. Actions are executed or escalated to human analysts.

Доказательства

Legacy SOAR GPU Hours 0, CPU‑Hours 8.5, Mean Engr. Interventions 3.2, Graphs/Minute 4.7; SENTINEL‑RL GPU Hours 0.12, CPU‑Hours 2.1, Mean Engr. Interventions 0.7, Graphs/Minute 18.2

Источник

[2024-06-11T14:52:22.561Z][INFO] Initiating subgraph walk for alert_id=a7f... [2024-06-11T14:52:22.880Z][WARN] Context reload triggered at depth=7, edge=(host_9,host_18)

Источник