Building TraceGuard: How I Built an Autonomous Security Incident Investigator with FalkorDB & MCP

Prajakta Sarkhel — Sun, 18 Oct 2026 15:40:44 +0000

🏆 Hackathon: Graph Hacks (by WeMakeDevs & FalkorDB)

🎯 Track: Agents That Act on Connected Data

👤 Author: Prajakta Sarkhel

🌐 Live Application: trace-guard-soc.onrender.com

📦 GitHub Repository: github.com/PrajaktaSarkhel/trace-guard

1. The Crisis in Modern SOCs: The Disconnected Log Nightmare

If you talk to any Security Operations Center (SOC) analyst, they will tell you their biggest frustration is alert fatigue.

Every day, enterprise SIEM systems (like Splunk, Okta, and AWS GuardDuty) spit out thousands of alerts in isolation. Suppose an alert fires: "Impossible Travel Login detected for Alice Vance from St. Petersburg, Russia."

What does the analyst have to do next?

Open Okta logs to find active session tokens.
Query SSH logs to see what internal servers were touched.
Check AWS CloudTrail to see if IAM policies were modified.
Inspect S3 access logs to verify what data was downloaded.
Query Threat Intelligence APIs to check the destination IP address.

By the time an analyst manually connects all these tables across five dashboards, hours or days have elapsed, while attackers exfiltrate data in minutes.

The fundamental flaw isn't a lack of telemetry. The flaw is the data model. Security telemetry is fundamentally a connected graph, yet we force analysts to query it as disjointed flat tables.

2. The Solution: TraceGuard

I built TraceGuard to transform security investigations from manual log searches into autonomous graph traversals.

Instead of isolated records, TraceGuard represents the enterprise as a connected property graph:
User ➔ Device ➔ Session ➔ Permission ➔ File/Vault ➔ Adversary IP

When an alert triggers, an autonomous AI agent traverses this graph step-by-step using multi-hop graph reasoning, calculates mathematical graph algorithms (Dijkstra attack paths, Blast Radius, Betweenness Centrality), and takes targeted containment actions with Human-in-the-Loop (HITL) approval.

You can try the live interactive dashboard right now at:

👉 https://trace-guard-soc.onrender.com/

3. Why FalkorDB is the Core Engine

A visualization on top of ordinary storage is just a dashboard. For an AI agent to dynamically reason across hundreds of thousands of relationships in milliseconds, it needs a low-latency, matrix-accelerated graph database.

FalkorDB was the perfect choice.

By leveraging GraphBLAS sparse matrix linear algebra under the hood, FalkorDB executes graph traversals orders of magnitude faster than traditional relational joins or legacy graph stores. In TraceGuard, FalkorDB is not a cache - it is the primary source of truth that the AI agent queries through openCypher.

The Graph Data Model

Nodes:
- :User - Corporate identity (id, label, department, mfa_status, risk_score)
- :Device - Endpoints & jump hosts (hostname, os, is_managed, risk_score)
- :Session - Active authentication tokens (ip_address, is_anomaly, auth_time)
- :Permission - IAM roles & privileges (cloud_provider, crown_jewel, risk_score)
- :File - Sensitive data vaults (path, classification, crown_jewel)
- :IP - External endpoints & C2 addresses (geo_country, threat_reputation)
- :Alert - Triggered detection events (title, severity, mitre_tactic)
Relationships:
- (:User)-[:AUTHENTICATED_ON]->(:Device)
- (:User)-[:SPAWNED_SESSION]->(:Session)
- (:Session)-[:ORIGINATED_FROM]->(:IP)
- (:Session)-[:GRANTED_PRIVILEGE]->(:Permission)
- (:Session)-[:ACCESSED_FILE]->(:File)
- (:File)-[:EXFILTRATED_TO]->(:IP)

4. The Agent Architecture & Model Context Protocol (MCP)

To make the AI agent modular and standards-compliant, I implemented the official Model Context Protocol (MCP) specification.

TraceGuard's MCP server exposes 6 high-level tools to the agent:

falkordb_cypher_query: Executes openCypher queries directly on FalkorDB.
security_graph_query: High-level graph operations (neighborhood expansion, Dijkstra pathfinding, blast radius, centrality).
siem_log_search: Full-text entity-correlated queries over CloudTrail and VPC flow logs.
threat_intel_lookup: Enriches IP indicators with threat reputation.
risk_assessment_tool: Composite topological risk scoring.
execute_mitigation_action: Executes automated and gated containment actions.

5. Under the Hood: The Cypher Queries That Power Investigations

Here are the real openCypher queries that execute inside FalkorDB during an investigation:

1. Multi-Hop Neighborhood Traversal

When investigating a suspicious entity, the agent expands surrounding connections:

MATCH (start {id: $node_id})-[r]-(neighbor)
RETURN neighbor.id AS id, 
       labels(neighbor) AS labels, 
       type(r) AS edge_type, 
       properties(neighbor) AS props;

2. Dijkstra Shortest Attack Path (shortestPath)

To reconstruct the exact attack trajectory from the compromised user to the C2 IP:

MATCH (origin {id: $source_id}), (exfil {id: $target_id})
MATCH p = shortestPath((origin)-[*..10]-(exfil))
RETURN [n IN nodes(p) | n.id] AS path_nodes,
       [r IN relationships(p) | type(r)] AS attack_hops,
       length(p) AS total_hops;

3. Blast Radius & Crown-Jewel Exposure Analysis

Quantifies all reachable enterprise assets within 3 hops and calculates high-value data exposure:

MATCH p = (origin {id: $node_id})-[*1..3]-(reachable)
RETURN DISTINCT reachable.id AS asset_id,
       labels(reachable) AS entity_type,
       reachable.crown_jewel AS is_crown_jewel,
       reachable.risk_score AS risk,
       length(p) AS hop_distance;

6. Acting on Connected Data: Safe Containment & Human-in-the-Loop

Autonomous agents in cybersecurity cannot be black boxes that blindly make destructive changes. TraceGuard splits containment into two policies:

Automated Safe Actions: Low-risk, immediate actions like killing compromised session tokens or creating P1 SOC incident tickets are executed automatically in real time.
Human-in-the-Loop (HITL) Approval Gate: High-impact actions, such as detaching production IAM policies or isolating critical jump hosts, require security analyst sign-off. When an analyst clicks Approve & Execute, the entity state in FalkorDB is immediately updated via Cypher:

MATCH (n {id: $target_id}) 
SET n.status = 'contained';

The node immediately turns neon green on the SOC canvas, confirming containment across the enterprise.

7. What I Learned Building with FalkorDB

Building TraceGuard was an eye-opening experience in how graph technology accelerates AI agents:

Matrix-Based GraphBLAS is Blazing Fast: In autonomous agent loops where the model makes multiple tool calls consecutively, slow database queries ruin the UX. FalkorDB’s sub-millisecond query execution made the multi-hop reasoning stream feel instantaneous.
openCypher is Natural for AI Reasoning: Writing Cypher queries felt intuitive and matched the way LLMs reason about relationship chains.
Graph Topology Beats Flat Risk Scores: An alert for an isolated laptop is low priority; an alert for a laptop connected to an active session with an admin IAM role that touches an S3 bucket with 450,000 SSN records is a Critical P1 incident. Graphs provide context that tables simply cannot express.

8. Conclusion & Resources

TraceGuard proves that the future of cybersecurity isn't more alerts - it’s connected intelligence. By combining FalkorDB with autonomous AI agents, we can shrink hours of manual log hunting into seconds of forensic clarity.

Live Demo: https://trace-guard-soc.onrender.com/
GitHub Repository: https://github.com/PrajaktaSarkhel/trace-guard
Built for: Graph Hacks (WeMakeDevs & FalkorDB)
Track: Agents That Act on Connected Data

Thank you to WeMakeDevs and FalkorDB for organizing an incredible hackathon!

DEV Community: Prajakta Sarkhel