OmniMemSOC

Title: Solving Agent Amnesia in Security Operations with FalkorDB & Tri-Layer Graph Memory

1. The Core Problem: Stateless Agent Amnesia in Autonomous SOCs Modern Security Operations Centers (SOCs) are drowning in alert volume. While autonomous AI agent swarms offer a promising solution for automated triage and containment, standard LLM-driven agents suffer from a fatal flaw: stateless memory loss.

When security agents process alerts, they operate in isolated execution cycles. Once a task completes, the agent forgets the contextual history of the attack, the compromised host topology, and the surrounding enterprise state. This "agent amnesia" leads to repeated work, inaccurate containment decisions, and zero cross-session intelligence.

1. The Solution: OmniMemSOC OmniMemSOC eliminates stateless agent memory loss by introducing a persistent, multi-tenant cognitive memory engine powered by FalkorDB Cloud.

Instead of treating memory as ephemeral text buffers, OmniMemSOC structures agent memory into a Tri-Layer Graph & Vector Schema:
-Episodic Memory: Records chronological attack timelines, alert occurrences, and state transitions.
-Semantic Memory: Stores 1536-dimensional vector embeddings using FalkorDB's native vector indices to perform sub-millisecond similarity searches against historical TTPs (Tactics, Techniques, and Procedures).
-Procedural Memory: Maps automated mitigation runbooks and MITRE ATT&CK techniques into reusable graph trees.

When a multi-agent swarm (Triage, Containment, and Forensic Agents) handles a threat—such as Kerberoasting or C2 beaconing—state transitions are serialized into immutable graph nodes. This guarantees a complete, audit-ready chain of custody across tenant boundaries (tenant-alpha, tenant-beta) with strict multi-tenant isolation.

1. Key Engineering Learnings -Graph-Native Vector Search is a Game Changer: Combining native property graph relationships with vector embeddings in FalkorDB enabled us to execute sub-millisecond attack path traversals while matching semantic threat similarity in a single query. -Deterministic Handoffs over Ephemeral Context: Passing structured graph schemas between specialized agents prevents hallucination and ensures zero-trust state integrity across complex incident response workflows.