AI-Powered Security Operations Center with Agentic AI for Threat Detection and Response

trellix · Tech · 2025 · source Agentic: yes · promotional bias: med · source-backed · extracted with prompt 0.5.4 (schema v2)

Generated from extraction.json — do not edit by hand. Every claim cites verbatim source evidence; stated means the quote directly asserts the claim, implied means it supports it indirectly.

Problem

Domain: Security operations and alert triage

Trellix targeted the SOC problem where human analysts cannot investigate the volume of low- and medium-priority alerts, even though sophisticated attackers often hide in that noise rather than triggering critical alerts.

Constraints:

• human analysts only have time for a small number of full investigations per day
• single security tools have narrow views and cannot provide full attack context
• SOC decisions need auditable reasoning and recommended actions, not opaque summaries
• agentic flows are nondeterministic and require careful prompt structure, tool controls, and QA
• model cost varies dramatically, so cheap classifiers and stronger analysis models must be selected deliberately

Architecture

Trellix built an agentic SOC workflow on Amazon Bedrock that treats security products and data sources as a toolbox. An incoming alert is classified by a cheaper model such as Amazon Nova Micro to choose investigation questions and retrieve relevant data. The system then uses a stronger reasoning model such as Claude Sonnet to analyze the full context, select additional tools, inspect evidence across GuardDuty, Security Hub, Security Lake, network/EDR/sandbox/intel/integration data, and decide whether the alert belongs in the analyst's actionable top set. Outputs include an auditable write-up, recommended actions, and optional automation such as updating Verified Access risk rather than simply enabling/disabling a user.

Diagram confidence: reconstructed (reconstructed from prose).

flowchart LR
  alert-intake["alert-intake"] --> nova-alert-classifier["nova-alert-classifier"]
  nova-alert-classifier --> investigation-question-builder["investigation-question-builder"]
  investigation-question-builder --> security-toolbox["security-toolbox"]
  security-toolbox --> sonnet-investigation-agent["sonnet-investigation-agent"]
  sonnet-investigation-agent --> security-toolbox
  case-note-guidance-loop["case-note-guidance-loop"] --> sonnet-investigation-agent
  sonnet-investigation-agent --> audit-and-ticketing-output["audit-and-ticketing-output"]
  model-qa-framework["model-qa-framework"] --> nova-alert-classifier
  model-qa-framework --> sonnet-investigation-agent

Components

Data flow

An alert enters the agent system with a goal and a toolbox. The system classifies the alert into predefined categories, generates high-level investigation questions, translates them into data lake/tool queries, retrieves network, endpoint, identity, vulnerability, intel, sandbox, and cloud-security context, and repeatedly returns to Bedrock to decide which tool to use next. A reasoning model reads the assembled context, decides whether the alert matters, writes up evidence and recommended actions, and can feed decisions into ticketing or access-risk systems with a transparent audit trail.

Why this architecture

Trellix uses agentic tool selection because security investigations depend on context scattered across many tools, and fixed playbooks break when the path changes. Cheap classification models can inspect more alerts economically, while stronger reasoning models analyze the assembled context and make the decision. The system constrains classification to known categories, structures prompts like onboarding a short-lived employee, and uses guidance from analyst case notes to adapt without creating brittle rules.

Models used: Amazon Bedrock · Amazon Nova Micro · Claude Sonnet · GuardDuty · Security Hub · Security Lake · Verified Access

Scale

• Trellix describes about 10 actionable alert investigations per analyst per day as the practical human capacity.
  “you probably only have time as an analyst to get through 10 alerts in one day for a real investigation.”transcript, stated
• Low-priority alert volume can be around 100 or 1000 per day.
  “when you get a login anomaly that's not that bad, right? There's 100 of those a day, maybe 1000 of those a day.”transcript, stated
• Trellix claims 500+ integrations for pulling security context.
  “we have 500+ integrations with everybody because we learned early on”transcript, stated
• The prompt framework treats each model call like onboarding an employee for about 15 seconds.
  “on boarding an employee that is going to be there for about 15 seconds”transcript, stated
• Customer preference guidance defaults to reading closed cases from the last 24 hours.
  “picks the timeline by default it's the last 24 hours, read through all the cases that they closed in the last 24 hours”transcript, stated
• The QA framework recommendation is to run GenAI tests at least 10 times because outputs are nondeterministic.
  “Anything you do in Gen AI as a testing framework, you have to do at least 10 times”transcript, stated
• Nova Micro is described as 100 times cheaper than some larger models.
  “It's 100 times cheaper than some of the other models on there.”transcript, stated

Alternatives considered (roads not taken)

critical-alert-only SOC triage

Rejected because: Skilled attackers avoid critical alerts and hide in low-level alert noise that humans do not have time to inspect.

single-tool alert summarization

Rejected because: A network alert alone can be summarized or enriched, but a full investigation requires context from other systems.

fixed scripted playbooks

Rejected because: A playbook follows one path and fails when conditions differ; agentic AI chooses tools dynamically as data arrives.

using the strongest model for every step

Rejected because: The system can use cheaper models for first-pass classification and reserve stronger models for deeper analysis.

Patterns

multi-agent-orchestration (agent-architecture)

The SOC system uses classification, investigation, tool-specific subagents, and orchestration agents to evaluate alerts across many data sources.

model-routing (model-operations)

Trellix routes cheap classification work to Nova and deeper reasoning work to Sonnet.

tool-use-orchestration (agent-architecture)

The agent repeatedly chooses from a toolbox of security tools, data lakes, sandboxing, intel, and access systems as evidence accumulates.

eval-driven-development (quality)

Trellix benchmarks prompts and models on its own security use cases, including hallucination checks and repeated nondeterministic samples.

agent-memory (context-management)

Recent closed case notes are converted into soft guidance so the system can reflect analyst preferences without hard-coding brittle rules.

Tradeoffs

Use agentic workflows rather than deterministic playbooks.

Chose goal plus toolbox with dynamic tool selection over fixed scripted playbooks.

Rationale: The agent can adapt its path as it discovers evidence, but that nondeterminism requires measurement and output review.

Use cheaper models for first-pass routing.

Chose Nova Micro for classification/question selection over running the most expensive reasoning model everywhere.

Rationale: Cheaper models make every-alert inspection more economically feasible, while larger models can handle deep analysis when needed.

Adjust access risk rather than always taking binary containment actions.

Chose nuanced Verified Access risk-score updates over immediate user disabling or quarantine.

Rationale: The agent can document why access should change without necessarily shutting the user off entirely.

Gotchas (what bit them)

Critical-only alert triage misses attacker behavior hidden in low-priority alerts.

Root cause: Humans do not have enough time to review every low-level alert, and strong attackers avoid noisy critical detections.

Resolution: Use AI agents to evaluate every alert and decide which low-level alerts deserve human investigation.

Asking the model to invent categories increases hallucination risk.

Root cause: Open-ended classification invites the model to create labels instead of making a constrained decision.

Resolution: Use a multiple-choice-style category list for alert classification.

Case-note learning can become brittle if treated as hard rules.

Root cause: An analyst note may be situational or even mistaken, and over-weighting it can distort future decisions.

Resolution: Turn closed-case notes into likely guidance weighed with current evidence rather than pre-training or rigid rules.

General model benchmarks do not tell you which model is right for SOC decisions.

Root cause: Security analysis depends on use-case-specific decoding, context assembly, and hallucination behavior.

Resolution: Build a specific QA framework and run many samples per prompt/model combination.

Evaluation

Trellix evaluates the system with use-case-specific QA rather than generic benchmarks: repeated nondeterministic runs, prompt/model comparisons, hallucination tracking, base64-decoding scenarios, and customer feedback on escalations and case outcomes.

Metrics: at least 10 test runs per GenAI benchmark scenario · hallucination rate by model/prompt · base64 decoding and decoded-content understanding · cost/capability comparisons such as Nova Micro being 100x cheaper · case drop after explicit customer tuning guidance

Outcomes

• the system can evaluate low-level alerts that humans would otherwise ignore
• agents produce detailed evidence write-ups for every alert
• customers use the write-ups to train level-one and level-two analysts
• customer case notes and explicit guidance can tune future decisions without changing each security tool

The transcript frames the scale around 100-1000 low-level login-anomaly alerts per day, roughly 10 full investigations per analyst per day, and 500+ integrations.