Agentic SOAR: LLM-Based Agents for Adaptive Playbook Generation and Automated Mitigation of Cyber Attacks

Traditional SOAR (Security Orchestration, Automation and Response) platforms automate incident response through static playbooks that are written in advance and are difficult to maintain. As attacks become faster and new threat variants keep emerging, this rigidity limits defenders' ability to respond effectively.

This thesis aims to design and develop a multi-agent system based on Large Language Models that, starting from an alert or a detected incident, analyzes its context (telemetry, threat intelligence, MITRE ATT&CK mapping) and dynamically generates a response playbook tailored to the specific threat. The playbook will be expressed in a standard, machine-readable format (OASIS CACAO v2.0) and executed through a controlled catalog of mitigation actions (e.g., host isolation, IoC blocking, credential revocation). High-impact actions will be subject to guardrails and will require human approval.

The work will include:

• A review of the state of the art on LLMs for incident response and on industry "agentic SOC" solutions;
• The design of the architecture, consisting of a coordinator agent and specialist agents for triage, analysis and response;
• The development of a prototype in a lab environment;
• An evaluation on simulated attack scenarios, comparing the generated playbooks with static ones in terms of correctness, coverage, response time and action safety.

References – Industry solutions and standards:

• CrowdStrike, Charlotte Agentic SOAR (press release, Nov. 2025): presented as replacing the rigidity of legacy SOAR with intelligent orchestration that connects agents, context and data across prevention, detection, investigation and response. https://ir.crowdstrike.com/news-releases/news-release-details/crowdstrike-unveils-charlotte-agentic-soar-orchestrate-agentic
• CrowdStrike, technical blog on Charlotte Agentic SOAR: built on Falcon Fusion SOAR as its orchestration backbone, with a visual workflow builder for orchestrating agents, connecting tools and setting guardrails. https://crowdstrike.com/en-us/blog/crowdstrike-leads-new-evolution-of-security-automation-with-charlotte-agentic-soar
• OASIS, CACAO Security Playbooks v2.0: specification defining the schema and taxonomy for cybersecurity playbooks, enabling them to be created and shared in a structured, standardized way. https://docs.oasis-open.org/cacao/security-playbooks/v2.0/security-playbooks-v2.0.html

· Cybersecurity

· Java or Python

· Basic knowledge of ICS/OT environments is a plus