GATRA

Manual SOC triage didn't scale, and the pain points were concrete:

• Alert overload. The SIEM emits far more alarms than a human team can read, let alone act on, and the majority are false positives or repeats of an alert already addressed.
• No cheap "is this real?" test. The only reliable triage is to check the artifact — is this IP actually malicious, is this credential actually leaked, is this login pattern actually an attack — which is slow and inconsistent by hand.
• Repetitive, mechanical response. Once an alert is confirmed, the response (notify the right people, open a ticket, write up the context) is templated busywork that still ate analyst time.
• Related alerts handled in isolation. A burst of bad-IP or credential-access alerts from the same root cause was triaged one-by-one instead of as a single incident.
• No conversational view of history. Answering "how many credential-leak true-positives this week?" meant someone writing BigQuery SQL by hand.
• LLMs need guardrails. Letting an LLM generate queries over production data demanded hard limits so it could only read, stay on security topics, and never run a destructive statement.

A pipeline of cooperating agents, fed by a poller and supervised through a dashboard.

A. Ingestion & orchestration

1. Middleware poller. Pulls new SIEM events + alarms from BigQuery in batches, flattens/joins them into one alarm object per alarmId, and skips anything already processed (no duplicate work). Each alarm is POSTed to the orchestrator.
2. Orchestrator. Runs ADA → TAA → CRA with early-exit gates: if ADA marks an alert handled (valid=False) it stops; if TAA finds it not a real threat it stops before any action. Tracks an agent_state row per alarm with status (in_progress, stopped_ada_invalid, completed_no_action, completed_with_action, completed_with_action_grouped, awaiting_group_dispatch, error).

B. The agents

1. ADA — Anomaly Detection Agent. Classifies each alarm into a case class (bad_ip, credential_leak, credential_access, other) and extracts the variable of importance (the artifact to check). It then queries existing records: if the artifact already exists in records → it was handled before → false positive (valid=False); if not → genuine, escalate (valid=True). Implemented as a DSPy ReAct agent with analyzer + record-check tools.
2. TAA — Triage & Analysis Agent. Takes ADA's verdict and actively validates the artifact with the right tool per case class — bad-IP reputation check, credential-leak validator — and assigns valid, severity, and confidence with reasoning. credential_access and other are assessed from context without an external tool. Tool/API failures degrade safely to valid=False with an explanation.
3. CRA — Containment & Response Agent. For confirmed threats it sends a templated notification email (per-case-class HTML templates — bad_ip.html, cred_leak.html, cred_access.html) to the responders and, for groupable classes, creates a Jira ticket. It accepts a pre-built email payload (grouped path) or constructs one itself (single path).

C. Grouping & dedup

1. Alert grouping. Before responding, related alerts are bucketed by a derived group key (e.g. case class + entity). A group manager accumulates pending alerts and a dispatch policy decides when to fire — so a burst of related alarms produces one consolidated ticket + email instead of dozens, with every member alarm linked to the same response and marked processed.

D. Supervision & analytics

1. Operations dashboard. A Streamlit app gives analysts an overview (volumes, case-class breakdowns, false-/true-positive rates, agent run-times), a per-agent activity view, IP-enrichment use-case views, and a feedback loop where analysts confirm or override agent verdicts.
2. LLM analytics copilot. A chat copilot answers plain-language questions over the case history by generating BigQuery SQL on the fly (text-to-SQL) and rendering the result — wrapped in a boundaries system that blocks destructive SQL and injection, keeps questions on-security-topic, and auto-applies safety LIMITs so the LLM can only run safe, read-only analytical queries.

• Triage at machine scale, 24/7. The detect→triage→contain loop runs continuously and consistently, removing the single biggest manual bottleneck in the SOC.
• Noise filtered automatically. ADA's record-check gate and TAA's active validation drop false positives and already-handled alerts before they reach a human.
• Mechanical response automated. Confirmed incidents get a notification email and Jira ticket with full agent reasoning attached — no analyst typing required.
• Incidents, not alerts. Grouping collapses bursts of related alarms into a single, coherent response, so responders see one incident instead of a flood.
• Fully auditable decisions. Every ADA/TAA/CRA verdict, with reasoning and run-time, is stored in BigQuery — the entire decision trail can be replayed and analyzed.
• Self-service analytics. Analysts query the whole case history in natural language instead of hand-writing SQL, safely bounded to read-only security questions.
• Human stays in the loop. The dashboard feedback path lets analysts correct agent verdicts, keeping people in control of the autonomy.