Event-Driven Agentic SOC (ED-ASOC): Supervisor-Based LLM Framework for Dynamic Incident Response and SOAR Orchestration

Creative Commons License

Özgözler E., Varol A., Tanrıverdi İ.

2026 14th International Symposium on Digital Forensics and Security (ISDFS), Massachusetts, Amerika Birleşik Devletleri, 19 - 20 Mart 2026, ss.1-5, (Tam Metin Bildiri)

  • Yayın Türü: Bildiri / Tam Metin Bildiri
  • Doi Numarası: 10.1109/isdfs69419.2026.11458922
  • Basıldığı Şehir: Massachusetts
  • Basıldığı Ülke: Amerika Birleşik Devletleri
  • Sayfa Sayıları: ss.1-5
  • Maltepe Üniversitesi Adresli: Evet

Özet

As cyber threats grow more sophisticated, Security Operations Centers (SOC) face mounting pressure from the gap between alert volumes and the speed of traditional incident response. Analysts struggle with cognitive overload caused by high false-positive rates, leading to alert fatigue and missed critical threats. Current SOAR platforms, despite automating routine tasks, rely on polling-based data retrieval and static playbooks that cannot adapt to polymorphic or zero-day attacks. This paper presents the Event-Driven Agentic SOC (ED-ASOC) framework, built around a Supervisor Agent that enables the shift from scripted automation to autonomous orchestration. By replacing periodic polling with Webhookbased real-time ingestion, the framework cuts detection-toanalysis latency from minutes to sub-second levels. The Supervisor Agent enriches raw telemetry with organizational context through Retrieval-Augmented Generation (RAG), producing adaptive responses that move beyond rigid rules. The agent can execute remediation actions, including IP blocking, endpoint isolation, and user suspension, via defined API schemas, closing the gap between detection and containment. A tiered Human-in-the-Loop (HITL) mechanism ensures that high-impact decisions require analyst approval. Experimental evaluation using FortiSIEM and FortiSOAR in a controlled testbed demonstrates a 73 % reduction in Mean Time to Response (MTTR) and 89 % decrease in detection latency compared to polling-based baselines, while reducing Tier-1 analyst workload by approximately 45%.