SentinelGraph: Building a Graph-Powered AI Cybersecurity Investigation Agent with FalkorDB

Description and use

SentinelGraph uses the FalkorDB graph database to connect and analyze security alerts, enabling investigators to explore relationships, evidence paths, and historical context, and to receive action recommendations that require human approval.

Problem

Security alerts are often treated as isolated records, making it hard to identify relationships, understand the bigger picture, and determine whether multiple signals belong to the same incident.

Outcome

SentinelGraph demonstrates that using a graph database to connect alerts, traverse relationships, trace evidence paths, and retrieve historical context can make AI‑powered cybersecurity investigations more contextual and explainable, while keeping analysts in control of response decisions.

Workflow

• Start with a set of security alerts
• Traverse relationships across the graph using FalkorDB to reveal multi‑hop connections
• Examine evidence paths that explain why alerts are related
• Retrieve historical incident memory for additional context
• Explain why candidates are grouped or excluded
• Recommend response actions subject to human review and approval

Evidence

Security alerts don’t exist in isolation

Source

Instead of treating security alerts as isolated records, represent them as connected data and use those relationships to support investigation.

Source

FalkorDB serves as the core graph database. Rather than looking at alerts independently, the investigation workflow uses graph relationships to explore connected entities, follow evidence paths, and retrieve relevant historical context.

Source

The investigation begins with a set of security alerts. For this demonstration, SentinelGraph uses synthetic security data, allowing the workflow to be explored without relying on real sensitive security information.

Source

After examining the available context, the system can recommend response actions. These recommendations remain subject to human review and approval or rejection.

Source