RootMesh: Building a Sub-Millisecond Autonomous Threat Memory Engine with FalkorDB

RootMesh: Building a Sub-Millisecond Autonomous Threat Memory Engine with FalkorDB
How we leveraged GraphBLAS sparse matrix operations, native graph algorithms, and custom JavaScript UDFs in FalkorDB to solve SOC alert fatigue and multi-hop cyber threat propagation.

The Problem: SOC Alert Fatigue and the Isolation Trap
Modern Security Operations Center (SOC) teams are drowning in alerts. On any given day, an enterprise network generates tens of thousands of log events across workstations, app servers, firewalls, and cloud infrastructure.

When a breach occurs, traditional SIEM and log analysis tools evaluate host events in isolation. A suspicious SMB connection on Host-A triggers alert #1; an unauthorized process on Host-B triggers alert #2. What existing tools miss is the connecting thread: the multi-hop lateral movement, privilege escalation, and network egress pathways that turn isolated events into catastrophic data breaches.

Furthermore, traditional AI security agents suffer from amnesia. Context windows reset between investigation sessions, losing critical episodic memory about past vulnerabilities, system owners, and containment outcomes.

We built RootMesh to eliminate this isolation trap.

Enter RootMesh: Graph-Native Threat Memory & Incident Response
RootMesh is an autonomous threat memory and real-time incident response engine powered by FalkorDB. Instead of treating enterprise security as isolated log streams, RootMesh models the entire organization as an interconnected Property Graph:

Topology Nodes: Hosts (:Host), Databases (:Database), VLAN Routers, and Egress Firewalls.
Vulnerability Nodes: CVE records (:CVE) like Log4Shell (CVE-2021-44228) and EternalBlue (CVE-2017-0144).
Company Brain Nodes: Teams (:Team) and Responders (:Person) with on-call schedules.
Threat Memory Nodes: Incident findings (:Finding) linked directly to affected infrastructure.
(PatientZero:Host) ──[:HAS_VULNERABILITY]──> (CVE-2017-0144)
│
[:COMMUNICATES]
▼
(AppServer:Host) ────[:STORED_ON]────> (Customer-Vault-DB)
│ │
[:COMMUNICATES] [:COMMUNICATES]
▼ ▼
(JumpServer:Host) ──[:EXPOSED_TO]──> (EgressFirewall:Host)
Deep Tech: How FalkorDB Powers Sub-Millisecond Security Reasoning
Building a real-time incident response engine requires sub-millisecond graph query performance. Here is how we utilized FalkorDB’s unique architecture to achieve sub-1.5ms reasoning speeds:

1. Variable-Length Cypher Traversals (*1..4) When ransomware (like WannaCry v2) infects a patient-zero host, RootMesh must instantly map all potential infection paths up to 4 hops deep before data exfiltration occurs.

Using FalkorDB's GraphBLAS sparse adjacency matrix engine, variable-length Cypher traversals execute blazingly fast:

MATCH path = (patientZero:Host {id: 'host-0'})-[:COMMUNICATES|EXPOSED_TO*1..4]->(target:Host)
RETURN target.name AS compromised_host,
length(path) AS distance,
[n IN nodes(path) | n.name] AS attack_vector
ORDER BY distance ASC
Because FalkorDB represents relationships as sparse matrices, traversing multi-hop pathways avoids expensive relational joins or recursive pointer-chasing, returning full attack graphs in <1.5 milliseconds.

1. Native Graph Algorithms: PageRank & MaxFlow Rather than pulling graph data into python memory to calculate risk scores, we pushed algorithmic computations directly onto FalkorDB's native procedures:

PageRank (algo.pageRank): We run PageRank over the COMMUNICATES graph topology to identify load-bearing infrastructure assets that represent single points of security failure.
MaxFlow (algo.maxFlow): We calculate maximum network egress capacity between compromised servers and internet-facing firewalls to quantify potential data exfiltration rates (in Mbps).
// Identify top 5 load-bearing infrastructure assets
CALL algo.pageRank('Host', 'COMMUNICATES')
YIELD node, score
RETURN node.name AS host, score
ORDER BY score DESC LIMIT 5

1. In-Database Monte Carlo Simulation via Custom JS UDFs Network breach propagation isn't purely deterministic—it's stochastic. Whether an infection spreads depends on node-level defenses (EDR presence, SMB signing, firewall status).

We wrote a custom JavaScript Monte Carlo simulation UDF (blast_radius) and registered it directly into FalkorDB using its C/JavaScript UDF API. This allows RootMesh to run 1,000 infection trials directly inside the database kernel without serializing graph state over the network:

function blast_radius(start_node_id, runs) {
let infected_counts = {};
for (let i = 0; i < runs; i++) {
let frontier = [start_node_id];
let visited = new Set([start_node_id]);
while (frontier.length > 0) {
let current = frontier.shift();
let neighbors = graph.traverse([current], {direction: 'outgoing'});
for (let neighbor of neighbors) {
if (!visited.has(neighbor.id)) {
let prob = 0.3;
if (!neighbor.properties.firewall) prob += 0.2;
if (!neighbor.properties.smb_signing) prob += 0.15;
if (!neighbor.properties.edr) prob += 0.25;

                if (Math.random() < prob) {
                    visited.add(neighbor.id);
                    frontier.push(neighbor.id);
                    infected_counts[neighbor.properties.name] =
                        (infected_counts[neighbor.properties.name] || 0) + 1;
                }
            }
        }
    }
}
return JSON.stringify(infected_counts);

}
falkor.register('blast_radius', blast_radius);

1. Persistent Episodic Memory & Multi-Tenant Subgraphs To prevent AI agent amnesia, RootMesh records investigation findings directly back into FalkorDB as persistent :Finding subgraphs:

MATCH (h:Host {id: $host_id})
CREATE (f:Finding {
id: $finding_id,
summary: 'Ransomware lateral propagation halted via automated EDR isolation',
timestamp: timestamp()
})
CREATE (f)-[:EVALUATED]->(h)
By leveraging select_graph(tenant_id), RootMesh provides strict multi-tenant isolation, ensuring security findings remain logically separated per organization while maintaining persistent cross-session memory.

What We Learned Building RootMesh
Push Computation to the Database: Running Monte Carlo simulations and graph algorithms inside FalkorDB via UDFs eliminated network serialization bottlenecks and reduced total response latency by over 80%.
Graphs Outperform Relational Joins for Security Topology: Multi-hop traversals over 4+ relationships are sluggish in SQL or document databases. GraphBLAS-backed matrix multiplication turns deep graph queries into constant-time sub-millisecond matrix ops.
Graph Memory is Key for Autonomous AI Agents: Vector search alone gives LLMs semantic retrieval, but property graphs give agents structural reasoning and episodic memory—allowing security agents to understand why assets are connected and who is responsible.
Conclusion & Future Roadmap
Building RootMesh for the FalkorDB Graph Hacks Hackathon proved that graph-native architectures are the missing foundation for autonomous AI security operations.

By combining FalkorDB's ultra-fast query execution, native graph algorithms, and custom UDF extensions, RootMesh delivers real-time incident response and persistent threat memory that helps SOC teams stay ahead of complex attacks.

Check out the open-source repository on GitHub and deploy RootMesh with Docker Compose in under 2 minutes!
GitHub:
https://github.com/Rahul9214