SecOps-Agent: Policy-Grounded LLM-Assisted Security Incident Response for Production Environments

Abstract

Security Operations Centers (SOCs) face increasing pressure from alert fatigue and complex incident response requirements across heterogeneous production environments. While Large Language Models (LLMs) show promise in automating security workflows, their deployment in production settings raises significant concerns about safety, auditability, and controlled execution. We present SecOps-Agent, a policy-grounded framework that leverages LLMs for security incident response while maintaining strict operational controls. Our approach introduces a Policy Grounding Engine that validates all LLM-generated response plans against role-based access control (RBAC) policies, predefined playbooks mapped to MITRE ATT&CK techniques, and change management windows before execution. The framework enforces a whitelist-only action model with mandatory dry-run validation and generates comprehensive audit trails linking all actions to supporting evidence. Experimental evaluation on a composite dataset of WAF alerts, Kubernetes audit logs, and cloud security events demonstrates that SecOps-Agent reduces Mean Time to Respond (MTTR) by 47.2% compared to traditional SOAR automation while maintaining a false action rate below 5%. Our results indicate that policy-grounded LLM agents can provide meaningful automation benefits in security operations while preserving the auditability and control requirements essential for production environments.