SENTINEL-RL: Offloading Topological Reasoning from LLM Agents in the Security Operations Center
SENTINEL-RL is an agentic-SOC architecture that decouples topological reasoning from semantic reasoning. It uses a heterogeneous graph attention encoder to summarize live authentication subgraphs into fixed-dimensional states, a Proximal Policy Optimization (PPO) policy to map states to constrained investigative actions, and an LLM agent loop restricted to consuming policy recommendations and producing analyst-readable narratives gated by a critic. The system was instantiated on the LANL Comprehensive, Multi-Source Cyber-Security Events dataset and the Indiana University Quartz HPC cluster. A two-phase CREATE ingestion pattern loads a 24M-edge authentication subgraph into Neo4j in 14.2 minutes on a single 32-core node, roughly 24x faster than the canonical MERGE-based pipeline.
Large language model (LLM) agents are increasingly proposed as autonomous SOC analysts, but two limitations make them unreliable at enterprise scale: a finite context window cannot hold a multi-thousand-host authentication graph, and free-form generation offers no guarantee that a recommended containment action is consistent with the topology it operates on. Sentinel-RL addresses these limitations by offloading topological reasoning to a graph-based RL policy while keeping the LLM for semantic narrative generation. The system was tested on LANL and Indiana University Quartz HPC cluster data, demonstrating a 24x faster ingestion of a 24M-edge authentication subgraph into Neo4j using a two-phase CREATE pattern.
The architecture separates topological reasoning (graph attention encoder + PPO policy) from semantic reasoning (LLM narrative generation with critic gating). This allows the system to handle large authentication graphs that exceed LLM context windows and ensures containment actions are topologically consistent. The reported 24x speedup in graph ingestion (14.2 minutes for 24M edges on a single 32-core node) suggests efficient use of Neo4j's CREATE pattern over MERGE, which is critical for real-time SOC operations.
This work addresses a key barrier to deploying LLM agents in security operations: the inability to reason over large, dynamic network topologies. By offloading topological reasoning to specialized RL components, the approach may enable more reliable autonomous SOC analysts, potentially reducing analyst workload and response times. The use of public datasets (LANL) and HPC infrastructure (Indiana University Quartz) indicates academic validation, but enterprise adoption would require integration with commercial SIEM/SOAR platforms.
If validated, Sentinel-RL could reduce the cost and risk of autonomous SOC operations by enabling LLM agents to operate on large-scale network topologies without context window limitations. This could lead to faster incident response, fewer false positives, and lower analyst burnout. The technology may be licensable to security vendors or integrated into existing SOAR platforms, creating a new market for topology-aware LLM agents in cybersecurity.
Next observable signals include: (1) publication of full results beyond the abstract, including detection and containment accuracy metrics; (2) open-sourcing of the Sentinel-RL codebase or model weights; (3) pilot deployments with enterprise SOC teams; (4) extension to other graph-based security tasks such as lateral movement detection or attack path analysis; (5) comparisons with alternative approaches like graph neural networks without RL or LLM-only baselines.