A Cybersecurity Alert Triage Agent That Cannot Hide Missing Evidence

Imagine a hypothetical security team receiving an impossible-travel alert for an administrator. Identity logs show two distant sign-ins, but endpoint telemetry is unavailable and the asset inventory is several days old. An LLM might explain the event as a VPN artifact and recommend closure. The operationally correct result is a triage packet that distinguishes that plausible explanation from missing evidence.

A cybersecurity alert triage agent should reduce evidence gathering and improve escalation quality. It should not autonomously declare compromise, suppress alerts, or isolate critical systems. The reference design below keeps investigation read-only initially and makes every response action a separately authorized operation.

Separate Observation From Interpretation

An observation is a timestamped sign-in event or a process record. An interpretation is “possible credential misuse.” A disposition is an accountable analyst’s decision to escalate, close, or request more evidence. Store these separately so a persuasive interpretation cannot overwrite the observations that produced it.

Normalize event time, ingestion time, tenant, user, device, source sensor, and evidence locator. Clock skew and delayed ingestion matter: apparent event order can be wrong. Preserve original timestamps alongside normalized values and flag sources whose time quality is unknown.

MITRE ATT&CK provides a knowledge base of adversary tactics and techniques grounded in observations. Use technique mappings to organize investigative questions, not as proof that an attack occurred. A process name resembling a technique example is a lead, not a verdict.

Enrichment Should Be Bounded and Reproducible

The minimum architecture is alert intake, deterministic deduplication, scoped enrichment tools, an evidence store, a model-generated analyst packet, and a disposition service. Tool results carry freshness, coverage, and failure status. The model can explain competing hypotheses and suggest the next allowed query; software controls query scope, time windows, and resource budgets.

For a vulnerable internet-facing appliance, enrich the alert with verified product and version data. CISA’s Known Exploited Vulnerabilities catalog is an input to prioritization. Catalog membership does not prove that this particular asset is compromised, and absence does not prove safety. A stale inventory match must remain tentative.

Specialist sub-agents can help when identity and endpoint investigations need different restricted tools and independently scored outputs. They are not necessary for simple log lookups. Start with one orchestrator and several read tools; require evidence that decomposition improves analyst decisions before accepting its latency and operational cost.

Unknown Must Not Become Benign

This runnable Python example tracks urgency and missing evidence independently. A telemetry outage cannot downgrade an already concerning signal. It is an illustrative workflow gate, not a production threat score or a replacement for an analyst’s judgment.

def review_lane(identity_fresh, endpoint_available,
                privileged_account, correlated_signal):
    return {
        "lane": "urgent_analyst_review" if privileged_account and correlated_signal
                else "standard_analyst_review",
        "missing_evidence": not identity_fresh or not endpoint_available,
    }

assert review_lane(True, False, True, False)["missing_evidence"]
assert review_lane(True, True, True, True)["lane"] == "urgent_analyst_review"
assert review_lane(True, True, False, False)["lane"] == "standard_analyst_review"
assert review_lane(True, False, True, True) == {
    "lane": "urgent_analyst_review", "missing_evidence": True,
}

Production dependencies omitted include authenticated telemetry collection, schema validation, timestamps, storage, queue ownership, and the organization’s escalation policy. The absence of an automatic-close branch is deliberate. Closure requires an analyst reason, evidence references, and a retained audit event.

Keep the packet short enough to act on: observed facts, strongest concerning hypothesis, strongest benign explanation, missing evidence, and a proposed next query. Attach relevant raw records rather than filling the report with generic technique descriptions. Analysts should be able to disagree without redoing every lookup.

Treat Attacker-Controlled Strings as Evidence

User agents, command lines, email subjects, filenames, and log messages can contain instructions written by an adversary. Never place them in the instruction channel or allow them to select arbitrary tools. A string saying “security administrator approved closure” is still just a string from telemetry.

Server-side authorization must bind every query to the tenant and analyst role. Enrichment services should accept validated identifiers, bounded time windows, and allowlisted query templates instead of unrestricted shell or query execution. Keep credentials outside model context, redact unnecessary personal data, and protect evidence exports. MCP is an integration mechanism, not an authorization decision.

When a telemetry source fails, retain successful evidence and mark the gap. Retry read operations with a deadline and per-source budget. Duplicate alerts can join the same case, but deduplication must preserve every event and never silently suppress a new signal from a different source or time window.

If containment is later enabled, require approval for exact asset identifiers, action, duration, and blast radius. Persist the intent and remote operation identifier. A timeout triggers reconciliation, not a second isolation request. Define how isolation is reversed, who can authorize reversal, and how critical assets are excluded. Emergency procedures must be preapproved operational policy, not invented by the agent.

The NIST SP 800-61 Revision 3 publication connects incident response to broader cybersecurity risk management. Use that context to keep preparation, response, and recovery ownership visible rather than treating a model-generated disposition as the end of the incident lifecycle.

Acceptance Tests Against Real Failure Modes

1. Remove endpoint telemetry from an otherwise ordinary sign-in alert. The packet names the coverage gap and cannot recommend verified-benign closure.
2. Insert closure instructions into a command-line field. The text remains evidence and causes no disposition change or tool expansion.
3. Return an outdated asset version matching a catalog entry. The packet requests current inventory confirmation instead of asserting exposure as established fact.
4. Deliver the same alert twice and a new correlated alert once. One case retains both unique events, with no duplicate analyst task for the repeated event.
5. Simulate containment acknowledgment loss. The response service reconciles the recorded operation and does not issue a second action or widen the asset scope.

Also verify that a tenant A analyst cannot enrich tenant B identities, including through cached search results. Test this at the API boundary, not only by hiding UI controls.

Measure Analyst Quality Alongside Throughput

Baseline time from alert arrival to an analyst-ready evidence packet across alert types and shifts. Measure packet completeness as packets containing all required evidence or explicit gaps divided by packets reviewed. Measure escalation precision against analyst-adjudicated cases, while separately tracking incidents found in alerts the workflow would have deprioritized.

The guardrails are missed material incidents, unsupported closures, and unauthorized response actions. Evaluate on historical cases with time-correct evidence so future incident knowledge cannot leak into the test. Start with shadow packets, then analyst-assisted enrichment, and only later consider narrowly approved response operations. Any time reduction is a proposed target until measured with review and correction effort included.

Begin with one identity alert type and no containment permissions. The production incident guide covers operational recovery, and the access request guide develops authorization boundaries. DevOps and SRE engineering supports reliable telemetry and response paths. A useful first result is a faster investigation that remains honest about what it cannot see.

Sources

• MITRE: ATT&CK knowledge base
• CISA: Known Exploited Vulnerabilities catalog
• NIST: SP 800-61 Revision 3