AgentSOC: Multi-Layer Agentic SOC Framework with Narrative Counterfactual Engine Achieves Sub-Second Triage on LANL Data

arXiv·medium signal

A new arXiv paper (2604.20134) presents AgentSOC, a multi-layer agentic AI framework for security operations automation that integrates perception, anticipatory reasoning, and risk-based action planning. The Narrative Counterfactual Engine (NCE) generates multiple attack hypotheses using LLM-based reasoning grounded in MITRE ATT&CK, while the Structural Simulation Engine (SSE) validates hypotheses against enterprise topology and privilege graphs. A proof-of-concept on LANL authentication data achieved 506ms processing time. This is the most architecturally complete agentic SOC framework published to date.