AI & Agentic Security Automation
Custom AI investigation agents orchestrating multi-source telemetry collection
I designed environment-aware AI agents that let an analyst begin with one investigative request, gather evidence in parallel, correlate activity across endpoint, identity, proxy, DLP, browser, collaboration, cloud, VPN, and physical-access systems, and package the results for human review.
Impact & Outcomes
Eliminated manual cross-console querying, saving over 20 hours of repetitive evidence collection per deep case.
Compressed first-pass investigative triage and structured timeline collation from days down to minutes.
Parallel correlation across endpoint, identity, DLP, proxy, cloud, VPN, browser, and badge telemetry.
Defensible, timestamped, source-bound reporting formatted for immediate executive and legal review.
The Challenge
Fragmented Data Across Disparate Silos
When investigating high-risk user anomalies, analysts historically had to jump across 6+ distinct dashboards—logging into CrowdStrike, Splunk, Proofpoint ITM, Zscaler, Azure AD, and physical badge systems manually. This created severe investigative latency and increased cognitive load.
When Generic AI Doesn’t Know Your Environment
Generic AI models do not know how a company names its indexes, sourcetypes, systems, or internal data. Without that context, they can confidently produce queries that look right but fail in the real environment. I grounded the agents in the schemas, relationships, and naming conventions analysts actually use so their output could support a real investigation.
How I Built the Investigation System
01. Environment-Aware Security Knowledge Mapping
Engineered explicit semantic maps connecting enterprise identity assets, index mappings, log formats, and tool relationships. Fed structured schema context to LLMs, enabling natural-language conversion to high-precision SPL and API queries.
02. Multi-Agent Orchestration Workflow
Built a multi-agent system where a Primary Orchestrator receives an investigative hypothesis and dispatches specialized sub-agents: Endpoint Agent (CrowdStrike/Tanium), Identity Agent (AD/Auth), DLP Agent (Proofpoint), and Collaboration Agent (M365/Teams).
What I Shipped
Automated Timeline & Evidence Synthesizer
The multi-agent pipeline extracts raw events, normalizes timestamps to a unified UTC baseline, resolves user-to-device mappings, and constructs a preliminary chronological timeline for analyst review.
Collaborative AI SPL Assistant
Built an environment-aware AI agent that works with analysts in plain language to draft, explain, and refine SPL using the organization’s real indexes, sourcetypes, and field conventions.