Can we use AutoGen (Microsoft Agent Framework) for advanced Cyber Security threat hunting?

All answers to this question.

Latency is always a concern with LLMs, but the "event-driven" nature of the newer Microsoft Agent Framework helps. We built a prototype where an agent monitors CloudWatch logs. When it sees an anomaly, it triggers the "Analyst Agent" to investigate. Because it’s asynchronous, the system doesn't "hang" waiting for a response. The biggest hurdle isn't the framework speed; it’s the LLM's accuracy. You still need a human-in-the-loop for the "Remediation" phase to ensure the agent doesn't accidentally shut down a production server thinking it’s under attack.

   Answered 2025-02-08 by Megan Price

How are you handling the context window when the logs get massive? I imagine a security agent would quickly run out of memory trying to read a 1GB log file.

   Answered 2025-02-10 by Joshua Evans

• Joshua, you shouldn't feed the raw logs to the LLM. We use a "RAG" (Retrieval-Augmented Generation) approach. An agent writes a script to parse the logs and only sends the relevant "suspicious" snippets to the LLM. This way, the agent stays within its context window and the processing stays incredibly cheap and fast.

     Commented 2025-02-12 by Larry Peterson

It’s great for the reporting side. Having an agent that knows the MITRE ATT&CK framework draft your initial incident findings saves the SOC team hours of paperwork.

   Answered 2025-02-14 by Michael Cook

• Paperwork is the bane of security! If AutoGen can automate 80% of the reporting, it’s worth the setup time alone.

     Commented 2025-02-16 by Ryan Reynolds