Building an Agentic SOC on a Stream

This post details the engineering of an Agentic Security Operations Center (SOC) that autonomously investigates security alerts. It describes a novel architecture featuring a central triage coordinator, specialized evidence agents, an adversarial evaluator, and a self-learning knowledge base. Key technical contributions include filtering duplicate alerts, enriching alerts with institutional knowledge, dispatching specialist agents for deep queries, adversarial review by a secondary agent to validate conclusions, and a streaming architecture for prioritized alert handling. Agent telemetry is streamed back to Confluent Cloud for real-time context and monitoring.