Autonomous Security Alert Triage Using LLM Based Agentic Investigation with Tool Augmented Reasoning

Security Operations Centers (SOCs) face an acute alert fatigue crisis, with analysts processing thousands of alerts daily while over 80% prove to be false positives. Existing automated triage solutions rely on static rule based playbooks or pretrained classifiers that require extensive labeled training data and fail to generalize across diverse alert types. This paper presents an autonomous alert triage framework that leverages Large Language Models (LLMs) with agentic tool augmented reasoning to investigate and classify security alerts without prior training data. Our approach introduces four key contributions: (1) a multi source data correlation pipeline that dynamically queries endpoint detection, threat intelligence, and incident management systems through a standardized tool integration protocol, enabling the LLM to perform real time evidence gathering; (2) a knowledge accumulation mechanism that builds institutional memory from past triage outcomes, improving classification accuracy over time without model retraining; (3) a layered prompt injection defense architecture that safely processes untrusted alert content within the LLM reasoning chain; and (4) a structured verdict extraction method that produces machine parseable triage outputs for downstream SOC workflow integration. We evaluate our framework on a production SOC environment processing 847 real world alerts spanning cloud identity threats, endpoint detections, and web application attacks over a 30 day period. Results demonstrate a mean triage time of 28 seconds (compared to 15 to 45 minutes for manual triage), 94.1% agreement with senior analyst verdicts (κ = 0.93), a weighted F1 score of 95.4% for severity classification, and 98% prompt injection resilience across adversarial test cases. The framework operates as a generalizable, vendor agnostic pipeline where the investigation strategy adapts dynamically based on alert content.