Security orchestration has traditionally relied on static playbooks. When an alert fires, a SOAR platform triggers a predetermined sequence of API calls, enrichment steps, and ticketing actions. This works for known threats, but modern attack surfaces generate noisy, ambiguous signals that rigid workflows cannot resolve. Large language models introduce adaptive reasoning into this pipeline, letting security platforms parse unstructured logs, correlate disparate alerts, and decide on remediation steps in real time.
The Problem with Static Security Playbooks
Static playbooks break when they encounter novel indicators or multi-stage intrusions. Analysts end up with ticket queues full of false positives, or worse, silent false negatives. The core issue is a lack of context. A playbook sees a single alert; it does not read firewall logs, email headers, and endpoint telemetry as a cohesive narrative. When the input data exceeds the playbook's predefined schema, the automation fails over to a human analyst, defeating the purpose of autonomous response.
How LLMs Enable Dynamic Orchestration
LLMs act as a reasoning layer between detection and response. Instead of hard-coded if-then logic, a model evaluates the full context of an incident, drafts investigative queries, and selects response tools. This shifts a SOAR platform from a script runner toward an autonomous agent. The practical gains show up in four areas:
- Unstructured data parsing. Models can read raw syslog, PDF incident reports, and email bodies without custom parsers.
- Multi-source correlation. Natural language reasoning connects disparate alerts across EDR, NDR, and identity platforms.
- Dynamic tool selection. Function calling lets the LLM decide which API to invoke, rather than following a fixed chain.
- Structured output. JSON mode returns deterministic objects for downstream automation, such as ticket fields or firewall rules.
Architecture Patterns for LLM-Driven SOAR
A typical implementation treats the LLM as an orchestration brain inside an event-driven pipeline. An incoming alert triggers a context-gathering phase, then the model reasons over the evidence and emits either a direct action or a follow-up question. Below is a minimal Python example using the OpenAI SDK, pointed at Oxlo.ai, to demonstrate function calling for security tool selection.
import openai
import json
client = openai.OpenAI(
base_url="https://api.oxlo.ai/v1",
api_key="YOUR_OXLO_API_KEY"
)
tools = [
{
"type": "function",
"function": {
"name": "query_siem",
"description": "Query the SIEM for related events in the last hour",
"parameters": {
"type": "object",
"properties": {
"host_id": {"type": "string"},
"event_type": {"type": "string"}
},
"required": ["host_id"]
}
}
},
{
"type": "function",
"function": {
"name": "isolate_host",
"description": "Trigger network isolation for a given endpoint",
"parameters": {
"type": "object",
"properties": {
"host_id": {"type": "string"}
},
"required": ["host_id"]
}
}
}
]
alert = "Suspicious PowerShell execution with encoded command on host WEB-01"
response = client.chat.completions.create(
model="llama-3.3-70b",
messages=[
{
"role": "system",
"content": "You are a security orchestration agent. Analyze the alert, gather evidence, and decide whether to isolate the host. Respond with tool calls only when confident."
},
{
"role": "user",
"content": f"Alert: {alert}"
}
],
tools=tools,
tool_choice="auto",
stream=False
)
if response.choices[0].message.tool_calls:
for call in response.choices[0].message.tool_calls:
print(f"Action: {call.function.name}")
print(f"Arguments: {call.function.arguments}")
else:
print("No action taken:", response.choices[0].message.content)
This pattern scales into multi-turn investigations. The model can query a SIEM, receive results, query an identity provider, and only then recommend containment, all within a single conversation thread.
Model Selection for Security Workloads
Not every security task needs the same model. The Oxlo.ai catalog covers the full spectrum, from lightweight triage to deep reasoning, all accessible through the same endpoint.
- Deep reasoning and complex coding. For multi-stage intrusion analysis or reverse-engineering malicious scripts, DeepSeek R1 671B MoE and Kimi K2.6 provide advanced chain-of-thought reasoning.
- Extreme long-context review. When you need to feed an entire day's worth of firewall logs or a large packet capture transcript, DeepSeek V4 Flash supports 1M context, and Kimi K2.6 handles 131K context.
- Agentic orchestration and tool use. For high-frequency SOAR playbooks that must call multiple APIs and maintain state, Qwen 3 32B, GLM 5, and Minimax M2.5 are optimized for agent workflows and tool use.
- General-purpose triage. Llama 3.3 70B and GPT-Oss 120B offer reliable performance for classification, summarization, and initial severity scoring.
Because Oxlo.ai carries 45+ models across 7 categories with no cold starts, you can route alerts to the right model tier without managing separate provider accounts.
Implementing the Orchestration Layer with Oxlo.ai
Oxlo.ai is a developer-first inference platform built for exactly these agentic, long-context workloads. It is fully OpenAI SDK compatible, so the code above runs unchanged after you swap the base URL to https://api.oxlo.ai/v1. There is no rewrite, no custom client, and no cold starts on popular models.
Where Oxlo.ai wins for security orchestration is pricing architecture. Token-based providers, including Together AI, Fireworks AI, OpenRouter, Replicate, and Anyscale, scale cost with prompt length. Security telemetry is verbose. A single incident might contain tens of thousands of tokens of logs, headers, and scan results. Under token billing, every enrichment step multiplies cost. Oxlo.ai uses flat per-request pricing: one fixed cost per API call regardless of input length. For long-context and agentic workloads, this can be significantly cheaper because your cost does not scale with input length.
This predictability matters for SOAR. You can stuff a full context window with forensic data, run multi-turn reasoning, and still know the exact cost per decision. For teams evaluating options, the Oxlo.ai pricing page breaks down the tiers: Free for prototyping with 60 requests per day across 16+ models, Pro at $80 per month for 1,000 requests per day, Premium at $350 per month for 5,000 requests per day with priority queue access, and Enterprise plans with dedicated GPUs and custom volume pricing.
Cost and Scale Considerations
Security is a long-context problem. SIEM queries, memory dumps, and vulnerability scan outputs do not compress well into short prompts. Agentic workflows compound the issue because each tool result is appended back into the conversation history. Token-based billing turns this necessary verbosity into a budget risk.
Oxlo.ai removes that variable. Because the platform charges per request, you can build thorough investigation agents without token math. Streaming responses, JSON mode, function calling, and vision support are all included, so you are not paying premiums for features that standard orchestration requires. If you are currently running inference through a token-based provider, the Enterprise tier even carries a guarantee of 30% savings off your current provider, backed by dedicated GPU resources.
Conclusion
Static playbooks are no longer sufficient for modern threat landscapes. LLMs let security teams build orchestration layers that reason over unstructured data, correlate cross-platform signals, and take action through dynamic tool use. The infrastructure powering these agents should not punish them for doing their job. Oxlo.ai offers a flat per-request pricing model, OpenAI SDK compatibility, and a broad catalog of reasoning and long-context models. For security engineers building the next generation of adaptive SOAR, it is a relevant, cost-effective inference backend.
Top comments (0)