TriageGraph
Agentic SOC analyst that autonomously triages SIEM alerts across identity, endpoint, cloud, and email telemetry — grounded in a MITRE ATT&CK RAG corpus, containment gated behind human approval.
Overview
A LangGraph multi-agent pipeline with real MCP servers, ATT&CK RAG over 697 techniques, Groq LLaMA-3.3-70B with a deterministic fallback, and a live React console (FastAPI/WebSocket, d3-force).
Problem
SOC teams drown in alert volume — thousands of SIEM alerts a day, mostly noise, each costing analyst minutes to dismiss safely. The result: alert fatigue, missed true positives, slow containment.
Approach
An agent runs the tier-1 investigation for every alert: queries logs, pivots on entities, maps behavior to ATT&CK, and hands humans only the alerts that matter with evidence gathered and containment one approval click away. Benchmarked: 100% triage accuracy and 100% false-positive suppression (LLM mode), 25% alert-noise reduction, 100% MCP tool-call success at ~14.7s per investigation.
Impact
Bridges my HPE security background and agentic-AI focus: autonomous where safe, human-gated at the blast radius — with every number reproducible from saved runs.