The multi-agent pipeline
The stages an incident passes through, and what each may touch
1. Orchestrator
Routes an incident through the pipeline, enforces stage ordering and preserves context.
case-readstage-dispatchGuardrail: Cannot execute response actions directly.
2. Monitoring Agent
Consumes normalized telemetry from every connector and raises candidate signals.
siem-readedr-readiam-readfirewall-reademail-readcloud-readGuardrail: Read-only across all sources.
3. ATT&CK Mapping Agent
Maps observed behaviour to public ATT&CK tactics, techniques and sub-techniques with rationale.
attack-taxonomyGuardrail: May only cite techniques present in the public taxonomy.
4. Threat Intelligence Agent
Enriches indicators, malware, actors and campaigns from the simulated TI platform.
ti-readGuardrail: Read-only; confidence and TLP always carried through.
5. Evidence Correlation Agent
Assembles the evidence package across sources, keeping supporting and contradicting items.
siem-readcmdb-readvuln-readGuardrail: Must retain contradicting evidence; may not discard it.
6. Risk Assessment Agent
Runs the deterministic risk model and returns factors, contributions and classification.
risk-modelGuardrail: Score comes from the model, never from a language model.
7. Decision Gate
Applies the human-approval matrix to the recommended action.
policy-evalGuardrail: Destructive High/Critical actions always require human approval.
8. Response Agent
Executes only allowlisted, scoped actions through approved APIs and a restricted service account.
edr-isolateiam-disableiam-revokefw-blockemail-quarantinesoar-ticketGuardrail: Refuses any action outside the allowlist; honours the kill switch.
9. Reporting Agent
Produces audience-scoped reports from one evidence set without altering source data.
case-readreport-renderGuardrail: Scoping only; may not introduce facts absent from evidence.
10. Continuous Learning Agent
Captures lessons learned and proposes detection and coverage improvements.
case-readcoverage-readGuardrail: Proposals only; cannot deploy detections.
Governance layer
Visible and enforced across every module
Each agent authenticates as its own restricted service principal with a distinct permission set; no shared credentials.
Role-scoped retrieval: an analyst query never returns board-restricted commentary, and a regulator view never returns raw endpoint telemetry.
Refusal on insufficient evidence, no fabrication, no severity invention, contradicting evidence preserved.
Approval matrix by severity; High requires SOC approval, Critical requires an authorized approver.
Only the twelve scoped response actions are callable; anything else is refused and logged.
Every observation, decision, recommendation and execution is written to an immutable, source-linked audit trail.
Every classification carries its evidence, its ATT&CK rationale and its risk factor breakdown.
Risk scoring and gate thresholds are deterministic policy; the language layer performs interpretation only.
Tested scenario catalogue
Questions verified to return a cited answer — or a correct refusal
Audit trail
What the agent saw, decided, recommended and executed — with role, sources and outcome
Decision Gate (Policy) · INC-2046 · Insufficient evidence confidence (0.66) — monitoring raised instead
Response Agent (Agent) · INC-2041 · Enrichment, log collection, ticket created
Decision Gate (Policy) · INC-2041 / ACT-ISOLATE · Approval requested from Authorized Approver
Risk Assessment Agent (Agent) · INC-2041 · Score 81 → Critical
ATT&CK Mapping Agent (Agent) · INC-2041 · T1566.002, T1078.002, T1059.001, T1003.001
Evidence Correlation Agent (Agent) · INC-2041 · Incident created, severity Critical
CISO / SOC Manager (CISO / SOC Manager) · INC-2042 / ACT-BLOCK-IP · Approved — 24h TTL deny rule
Response Agent (Agent) · INC-2044 / wipe-and-reimage · Refused: action not on the response allowlist
On-call Approver (On-call Approver) · INC-2044 / ACT-ISOLATE · Approved — executed via scoped EDR API
Reporting Agent (Agent) · INC-2045 · Closed-Benign with rationale retained