SentinelGraph: Building a Graph-Powered AI Cybersecurity Investigation Agent with FalkorDB

说明与用途

SentinelGraph 使用 FalkorDB 图数据库连接并分析安全警报，使调查员能够探索关系、证据路径和历史上下文，并获得需要人工批准的操作建议。

问题

Security alerts are often treated as isolated records, making it hard to identify relationships, understand the bigger picture, and determine whether multiple signals belong to the same incident.

结果

SentinelGraph demonstrates that using a graph database to connect alerts, traverse relationships, trace evidence paths, and retrieve historical context can make AI‑powered cybersecurity investigations more contextual and explainable, while keeping analysts in control of response decisions.

工作流

• Start with a set of security alerts
• Traverse relationships across the graph using FalkorDB to reveal multi‑hop connections
• Examine evidence paths that explain why alerts are related
• Retrieve historical incident memory for additional context
• Explain why candidates are grouped or excluded
• Recommend response actions subject to human review and approval

证据

Security alerts don’t exist in isolation

来源

Instead of treating security alerts as isolated records, represent them as connected data and use those relationships to support investigation.

来源

FalkorDB serves as the core graph database. Rather than looking at alerts independently, the investigation workflow uses graph relationships to explore connected entities, follow evidence paths, and retrieve relevant historical context.

来源

The investigation begins with a set of security alerts. For this demonstration, SentinelGraph uses synthetic security data, allowing the workflow to be explored without relying on real sensitive security information.

来源

After examining the available context, the system can recommend response actions. These recommendations remain subject to human review and approval or rejection.

来源