Sentinel‑RL is an SOC agent architecture that separates topological reasoning from language reasoning by encoding live authentication graphs into a fixed‑dimensional state for a PPO policy, letting an LLM generate analyst‑readable narratives based on the policy’s actions.
The finite context window of LLMs prevents them from holding multi‑thousand‑host graphs, so Sentinel‑RL offloads that to a graph attention encoder. The PPO policy selects from a constrained action set, ensuring topology‑consistent containment steps. An LLM then produces human‑friendly explanations, gated by a critic for safety. The design was evaluated on the LANL Comprehensive dataset.
