SentinelGraph

Praveen Rajan — Sun, 18 Oct 2026 13:58:09 +0000

Title: Building Autonomous Cyber Incident Response using Model Context Protocol & FalkorDB

The Core Problem: Fragmented Context in Incident Response
Security analysts and autonomous security tools struggle to correlate alerts across siloed infrastructure. When an Incident Response (IR) agent investigates an alert, retrieving contextual telemetry—such as open ports, compromised credentials, and active network connections—requires complex multi-hop queries that traditional relational or document databases process far too slowly.
The Solution: SentinelGraph
SentinelGraph addresses this challenge by pairing FalkorDB's graph analytics engine with the Model Context Protocol (MCP). This architecture exposes live graph analytics directly to autonomous security agents as standardized tools.
Through native OpenCypher queries and graph algorithms like PageRank and Betweenness Centrality, SentinelGraph allows AI agents to:
-Instantly identify crown-jewel assets at risk during active lateral movement.
-Traverse complex multi-hop attack graphs in under 2 milliseconds.
-Execute autonomous containment actions via FastAPI backends and Next.js control dashboards.

By leveraging MCP, security agents can inspect infrastructure topologies, run attack graph traversals, and log forensic insights without exposing raw database credentials or sacrificing system boundaries.

Key Engineering Learnings -Graph Centrality Exposes Blast Radius: Graph algorithms like PageRank provide immediate quantitative scoring for asset criticality, allowing containment agents to prioritize isolation where it matters most. -Standardizing Agent Tools via MCP: Standardizing tool execution via Model Context Protocol drastically reduces agent integration friction, creating a clean abstraction layer between LLM reasoning and graph database operations.

OmniMemSOC

Praveen Rajan — Sun, 18 Oct 2026 13:54:22 +0000

Title: Solving Agent Amnesia in Security Operations with FalkorDB & Tri-Layer Graph Memory

The Core Problem: Stateless Agent Amnesia in Autonomous SOCs Modern Security Operations Centers (SOCs) are drowning in alert volume. While autonomous AI agent swarms offer a promising solution for automated triage and containment, standard LLM-driven agents suffer from a fatal flaw: stateless memory loss.

When security agents process alerts, they operate in isolated execution cycles. Once a task completes, the agent forgets the contextual history of the attack, the compromised host topology, and the surrounding enterprise state. This "agent amnesia" leads to repeated work, inaccurate containment decisions, and zero cross-session intelligence.

The Solution: OmniMemSOC OmniMemSOC eliminates stateless agent memory loss by introducing a persistent, multi-tenant cognitive memory engine powered by FalkorDB Cloud.

Instead of treating memory as ephemeral text buffers, OmniMemSOC structures agent memory into a Tri-Layer Graph & Vector Schema:
-Episodic Memory: Records chronological attack timelines, alert occurrences, and state transitions.
-Semantic Memory: Stores 1536-dimensional vector embeddings using FalkorDB's native vector indices to perform sub-millisecond similarity searches against historical TTPs (Tactics, Techniques, and Procedures).
-Procedural Memory: Maps automated mitigation runbooks and MITRE ATT&CK techniques into reusable graph trees.

When a multi-agent swarm (Triage, Containment, and Forensic Agents) handles a threat—such as Kerberoasting or C2 beaconing—state transitions are serialized into immutable graph nodes. This guarantees a complete, audit-ready chain of custody across tenant boundaries (tenant-alpha, tenant-beta) with strict multi-tenant isolation.

Key Engineering Learnings -Graph-Native Vector Search is a Game Changer: Combining native property graph relationships with vector embeddings in FalkorDB enabled us to execute sub-millisecond attack path traversals while matching semantic threat similarity in a single query. -Deterministic Handoffs over Ephemeral Context: Passing structured graph schemas between specialized agents prevents hallucination and ensures zero-trust state integrity across complex incident response workflows.

DEV Community: Praveen Rajan

SentinelGraph

OmniMemSOC