Sentinel-RL is an agentic SOC architecture that decouples topological reasoning from semantic reasoning. It uses a heterogeneous graph attention encoder to summarize the authentication graph into a fixed state, a PPO policy to map that state to constrained investigative actions, and restricts the LLM to producing narratives from the policy's recommendations.
On the LANL dataset, a two-phase CREATE ingestion pattern loaded a 24M-edge graph into Neo4j in 14.2 minutes, 24x faster than MERGE. A sliding-window alert engine tripped a threshold in <=2.5s. PPO training over 200 iterations achieved mean return 8.74, held-out precision 0.91, recall 0.87. The end-to-end detect-investigate-recommend-approve cycle completed in median 6.3s.
This is interesting because it addresses the two key limitations of LLM agents in SOC: finite context windows and free-form generation, by offloading topology-aware decision-making to a trained policy, enabling enterprise-scale deployment with auditable actions.