Sentinel-RL moves the graph reasoning out of the LLM so a SOC agent can operate on a 24M-edge auth graph

arXiv·medium signalXBlueskyLinkedInCopy link

The architecture separates topological from semantic reasoning: a heterogeneous graph attention encoder compresses the live authentication subgraph into a fixed-dimensional state, a PPO policy maps that state to a constrained set of investigative actions, and the LLM loop is restricted to consuming those recommendations and writing analyst-readable narratives gated by a critic. On LANL's cyber-security events dataset and Indiana University's Quartz cluster, a two-phase CREATE ingestion loads 24M edges into Neo4j in 14.2 minutes on one 32-core node, roughly 24x faster than the canonical MERGE pipeline; PPO converges to held-out precision 0.91 and recall 0.87, and the full detect-investigate-recommend-approve loop completes in a median 6.3 seconds. The reusable part for builders is the pattern of keeping the LLM out of anything that exceeds its context window.