Constrained-Action AI Remediation for SIEM/XDR via a NeMo-Guardrails Proxy
A NeMo-Guardrails proxy and closed intent vocabulary constrain unsafe LLM remediation commands in SIEM and XDR.
The paper proposes a two-layer design so SOC language models cannot turn an adversarial alert into host commands such as blocking IPs, killing processes, or quarantining files. A SIEM/XDR control plane limits output to a closed intent vocabulary executed by thin endpoint agents and checked by an argument validator. A stock NeMo-Guardrails proxy lifts injection recall from 25.0% to 94.5% at a 0.1% false-positive rate on a released SOC adversarial corpus. A live red-team exercise found observed failure modes were contained before any command crossed the trust boundary; measured latency keeps inline control out of scope.
- Closed intent vocabulary and argument validator backstop endpoint commands
- Guardrails raise injection recall from 25.0% to 94.5% at 0.1% FPR
- Live red team saw failures contained before the trust boundary
- Authors recommend human-in-the-loop or delayed operation
Full article238 words · extracted from arxiv.org · click to collapse
Security Operations Centers (SOCs) for information technology and operational technology share one incident-response problem: a flood of correlated alerts and too few analysts. Large Language Models (LLMs) are increasingly proposed as reasoning engines that triage alerts and, in autonomous deployments, issue commands that block IPs, kill processes, or quarantine files on production hosts. This coupling introduces a new risk: a single adversarial alert can become a remote code path through the LLM's reasoning, leading it to recommend an action the SOC then executes. We present a constrained-action architecture with two coordinated layers: (i) a SIEM/XDR control plane that grounds remediation in correlated host events and confines the LLM's output to a closed intent vocabulary whose templated commands are executed by thin endpoint agents, backstopped by an argument validator; and (ii) a NeMo-Guardrails proxy that wraps the SOC-analyst LLM with input- and output-rail policies, evaluated out-of-the-box against a SOC-specific adversarial corpus we release. The stock proxy lifts injection recall from 25.0% to 94.5% at a 0.1% false-positive rate, and a live red-team exercise confirms that the closed intent vocabulary and argument validator contain the observed LLM failure modes before any command crosses the trust boundary. As an architectural fit (not yet a measured operational-technology deployment), the constrained-action property suits critical-infrastructure settings where a wrong remediation has physical, not merely operational, consequences. The loop is best run human-in-the-loop or delayed: the measured rail latency keeps inline control out of scope.
Text extracted automatically; images, tables and formatting may be missing. Original: https://arxiv.org/abs/2610.09906