SOURCE-LINKED INTELLIGENCE

SENTINEL-RL: Offloading Topological Reasoning from LLM Agents in the Security Operations Center

arXiv · AI, language, vision and robotics · article · Sep 3, 2026 · UTC

Large language model (LLM) agents are increasingly proposed as autonomous SOC analysts, but two limitations make them unreliable at enterprise scale: a finite context window cannot hold a multi-thousand-host authentication graph, and free-form generation offers no guarantee that a recommended containment action is consistent with the topology it operates on. We present Sentinel-RL, an agentic-SOC architecture that decouples topological reasoning from semantic reasoning: a heterogeneous graph attention encoder summarizes the live authentication subgraph into a fixed-dimensional state, a Proxima

Read original source ↗ Open in workspace

recordType

paper

region

Global