End-to-End LLM Framework for Autonomous Security Operations Center Workflows

arXiv·medium signal

Integrates ensemble-based threat detection, syntax-constrained query generation, and retrieval-augmented resolution support to automate SOC workflows end-to-end. Combines a Narrative Counterfactual Engine for attack hypothesis generation using MITRE ATT&CK with structural simulation for validation. Processes LANL authentication data in 506ms — moving toward fully autonomous tier-1 SOC operations.