SENTINEL-RL: Offloading Topological Reasoning from LLM Agents in the Security Operations Center

SENTINEL‑RL is an agentic SOC architecture that separates topological reasoning from semantic reasoning. It uses a heterogeneous graph attention encoder to compress a large authentication subgraph into a fixed‑dimensional state, a PPO policy to map that state to constrained investigative actions, and an LLM loop that only consumes policy recommendations and produces analyst‑readable narratives. Experiments on LANL and Indiana University datasets show fast graph ingestion, reliable alerting, high PPO performance, and a median 6.3‑second containment cycle.

Machine-generated by The Flow from the publisher's headline and feed description — not written or checked by a human. The full article lives at arXiv AI.

• llms
• agents
• reinforcement-learning