SentinelGraph: Building a Graph-Powered AI Cybersecurity Investigation Agent with FalkorDB

Описание и применение

SentinelGraph использует графовую базу данных FalkorDB для связывания и анализа тревог безопасности, позволяя исследователям просматривать связи, доказательства и исторический контекст, а также получать рекомендации действий с обязательной проверкой человека.

Задача

Security alerts are often treated as isolated records, making it hard to identify relationships, understand the bigger picture, and determine whether multiple signals belong to the same incident.

Результат

SentinelGraph demonstrates that using a graph database to connect alerts, traverse relationships, trace evidence paths, and retrieve historical context can make AI‑powered cybersecurity investigations more contextual and explainable, while keeping analysts in control of response decisions.

Рабочий процесс

• Start with a set of security alerts
• Traverse relationships across the graph using FalkorDB to reveal multi‑hop connections
• Examine evidence paths that explain why alerts are related
• Retrieve historical incident memory for additional context
• Explain why candidates are grouped or excluded
• Recommend response actions subject to human review and approval

Доказательства

Security alerts don’t exist in isolation

Источник

Instead of treating security alerts as isolated records, represent them as connected data and use those relationships to support investigation.

Источник

FalkorDB serves as the core graph database. Rather than looking at alerts independently, the investigation workflow uses graph relationships to explore connected entities, follow evidence paths, and retrieve relevant historical context.

Источник

The investigation begins with a set of security alerts. For this demonstration, SentinelGraph uses synthetic security data, allowing the workflow to be explored without relying on real sensitive security information.

Источник

After examining the available context, the system can recommend response actions. These recommendations remain subject to human review and approval or rejection.

Источник