SOCsentinel: Multi-Agent LLM SOC Analyst

SOCsentinel is a fully autonomous multi-agent LLM platform that replicates the entire SOC (Security Operations Center) analyst hierarchy using 9 specialized AI agents running Qwen3 models on AMD MI300X via vLLM and ROCm. Security Operations Centers are overwhelmed: 11,000 alerts/day, 45-minute average triage time, 78% analyst burnout, and 68% of alerts go uninvestigated. Human analysts simply cannot keep up with modern threat volumes. SOCsentinel solves this by deploying a coordinated multi-agent pipeline that automates L1-L3 triage, evidence collection, MITRE ATT&CK mapping (RAG-grounded with 697 techniques via ChromaDB), Sigma rule generation, investigation reporting, and containment playbook creation - all in under 2 minutes. Each of the 9 agents uses a tailored Qwen3 model (4B for fast triage, 7B for analysis, 14B for report writing) with role-specific system prompts and guardrails. The platform features real-time SSE streaming where users can watch the entire investigation pipeline execute live with animated agent collaboration graph visualization. A self-improving feedback loop ensures analyst corrections automatically calibrate future AI triage classifications with visible learning metrics. The Human-in-the-Loop Analyst Workbench provides confidence override sliders, auto-generated risk summaries, decision history, and full audit trail - ensuring AI augments rather than replaces human judgment. Additional features include Qwen3 "Thinking Mode" for Chain-of-Thought reasoning visibility, a one-click benchmark dashboard across 5 attack scenarios, and executive summary banners with kill chain progress and recommended actions. The tech stack consists of FastAPI + LangChain + ChromaDB on the backend, React + TypeScript + TailwindCSS on the frontend, and Qwen3 (4B/7B/14B) served via vLLM on AMD MI300X (192GB HBM3) using AMD Developer Cloud and ROCm 6.x.