Autonomous Security Alert Triage Using LLM Based Agentic Investigation with Tool Augmented Reasoning

Sunil Kumar and Irfan Khan

International Journal of Scientific Research in Computer Science, Engineering and Information Technology, 2026, vol. 12, issue 2, 752-765

Abstract: Security Operations Centers (SOCs) face an acute alert fatigue crisis, with analysts processing thousands of alerts daily while over 80% prove to be false positives. Existing automated triage solutions rely on static rule based playbooks or pretrained classifiers that require extensive labeled training data and fail to generalize across diverse alert types. This paper presents an autonomous alert triage framework that leverages Large Language Models (LLMs) with agentic tool augmented reasoning to investigate and classify security alerts without prior training data. Our approach introduces four key contributions: (1) a multi source data correlation pipeline that dynamically queries endpoint detection, threat intelligence, and incident management systems through a standardized tool integration protocol, enabling the LLM to perform real time evidence gathering; (2) a knowledge accumulation mechanism that builds institutional memory from past triage outcomes, improving classification accuracy over time without model retraining; (3) a layered prompt injection defense architecture that safely processes untrusted alert content within the LLM reasoning chain; and (4) a structured verdict extraction method that produces machine parseable triage outputs for downstream SOC workflow integration. We evaluate our framework on a production SOC environment processing 847 real world alerts spanning cloud identity threats, endpoint detections, and web application attacks over a 30 day period. Results demonstrate a mean triage time of 28 seconds (compared to 15 to 45 minutes for manual triage), 94.1% agreement with senior analyst verdicts (κ = 0.93), a weighted F1 score of 95.4% for severity classification, and 98% prompt injection resilience across adversarial test cases. The framework operates as a generalizable, vendor agnostic pipeline where the investigation strategy adapts dynamically based on alert content.

Keywords: Security Operations Center; Alert Triage; Large Language Models; Agentic AI; Tool Augmented Reasoning; Prompt Injection Defense; Multi Source Data Correlation; Knowledge Accumulation (search for similar items in EconPapers)
Date: 2026
Note: Article URL: https://ijsrcseit.com/home/article/view/CSEIT261213109
References: Add references at CitEc
Citations:

Downloads: (external link)
https://ijsrcseit.com/home/article/view/CSEIT261213109 Article URL (text/html)
https://ijsrcseit.com/home/article/download/CSEIT261213109/CSEIT261213109 Full text (application/pdf)

Related works:
This item may be available elsewhere in EconPapers: Search for items with the same title.

Export reference: BibTeX RIS (EndNote, ProCite, RefMan) HTML/Text

Persistent link: https://EconPapers.repec.org/RePEc:jbh:ijsrcs:v12:y2026:i2:id:1978

DOI: 10.32628/CSEIT261213109

Access Statistics for this article

More articles in International Journal of Scientific Research in Computer Science, Engineering and Information Technology from International Journal of Scientific Research in Computer Science, Engineering and Information Technology
Bibliographic data for series maintained by Pankaj Sharma (USA) ().