Autonomous Security Agents. No Analyst Required.
6-agent NIM pipeline orchestrated by NeMo planner with chain-of-thought reasoning. MTTR from hours to under 5 minutes. 90% autonomous resolution. Attack chain reconstruction in 200-500ms on H100. Pre-approved containment across firewall, EDR, IdP, and OT.
Ingest & Detect
Morpheus + TensorRT2M+ events/sec processed through NVIDIA Morpheus. TensorRT INT8 inference scores every event in under 0.4ms.
Correlate & Reconstruct
RAPIDS cuDF + cuGraphTelemetry correlation via cuDF joins. HAN GNN reconstructs attack chains across 5 entity types in 200-500ms.
Assess & Report
NeMo LLM + GuardrailsBlast radius prediction identifies hosts at risk. NeMo generates SOC-ready investigation report with confidence scores.
Contain & Respond
NIM MicroservicesPre-approved playbooks execute containment — isolate hosts, revoke credentials, block IPs. Auditable and reversible.
Agent Capabilities
Agent 1: Telemetry Correlation
Queries RAPIDS-backed telemetry lake (cuDF joins across endpoint, network, identity, cloud). Retrieves all events correlated with flagged entity within configurable time window. Runs on A10G GPU.
Agent 2: Attack Chain Reconstruction
Loads correlated events into HAN (Heterogeneous Graph Attention Network). cuGraph + PyG on 5 node types: user, device, process, network flow, file object. Computes most probable attack path in 200-500ms on H100.
Agent 3: Threat Intelligence Enrichment
Maps observed TTPs to MITRE ATT&CK technique IDs. Queries CISA KEV for known exploited CVEs, FS-ISAC sector-specific feeds. NeMo Retriever-backed RAG pipeline.
Agent 4: Blast Radius Assessment
Projects lateral movement risk using predictive model. Identifies hosts at >80% probability of compromise in next 15 minutes based on network reachability and behavioral similarity.
Agent 5: Report Generation
NeMo LLM (Llama-3-based, fine-tuned on SOC incident reports). NeMo Guardrails prevent hallucinated CVE IDs and incorrect severity scores. Outputs: executive summary, timeline, attack chain diagram, affected systems, recommended response, confidence.
Agent 6: Response Execution
Pre-approved containment via firewall (Palo Alto/Fortinet), EDR (CrowdStrike/SentinelOne), IdP (Okta/Entra ID), OT (Quellra Edge PLC isolation). All actions logged with timestamps, confidence scores, reversibility flags. Risk-scored, auditable, reversible.
NeMo Planner with Chain-of-Thought Reasoning
Every investigation is orchestrated by NVIDIA NeMo planner with chain-of-thought reasoning. The planner sequences the 6-agent NIM pipeline, passing outputs from one agent as inputs to the next: telemetry correlation → attack chain reconstruction → threat intel enrichment → blast radius assessment → report generation → response execution. Each agent runs on NVIDIA NIM microservices with TensorRT-optimized inference. GPU acceleration on A10G and H100 drives subsecond graph inference and real-time containment.
Agent API
import { Quellra } from "@quellra/sdk"; const client = new Quellra({ apiKey: process.env.QUELLRA_KEY }); // Launch 6-agent NIM pipeline (NeMo planner orchestrates)const investigation = await client.agents.investigate({ trigger: "alert:lateral-movement-detected", scope: { assets: ["srv-prod-*", "endpoint-finance-*"], timeWindow: "last_4h", }, pipeline: [ "telemetry_correlation", // Agent 1: RAPIDS-backed cuDF joins "attack_chain_reconstruction", // Agent 2: HAN (cuGraph + PyG on H100) "threat_intel_enrichment", // Agent 3: MITRE ATT&CK + CISA KEV + FS-ISAC "blast_radius_assessment", // Agent 4: Predictive lateral movement risk "report_generation", // Agent 5: NeMo LLM + Guardrails "response_execution", // Agent 6: Firewall + EDR + IdP + OT ], escalation: { threshold: "critical", channel: "pagerduty", },}); console.log(investigation.id); // "inv_8x2kLm9..."console.log(investigation.status); // "containing"console.log(investigation.attackChainMs); // 487 (H100 graph inference)Measurable Outcomes
MTTR < 5 Minutes
Mean time to respond drops from hours to under 5 minutes. 6-agent NIM pipeline orchestrated by NeMo planner with chain-of-thought reasoning investigates and contains autonomously.
90% Autonomous Resolution
Nine out of ten incidents resolved without human intervention. Agents handle the entire pipeline: correlation → reconstruction → enrichment → blast radius → report → containment.
<500ms Attack Chain
Heterogeneous Graph Attention Network (HAN) computes most probable attack path in 200-500ms on H100. cuGraph + PyG on 5 node types. JSON output with confidence scores.
Risk-Scored, Auditable, Reversible
Every containment action logged: timestamp, confidence score, reversibility flag. Pre-approved playbooks across firewall, EDR, IdP, and OT. Full forensic trail.
NeMo LLM + Guardrails: Zero Hallucinations
Agent 5 uses NeMo LLM (Llama-3-based, fine-tuned on 10,000+ SOC incident reports) to generate executive summary, timeline, attack chain diagram, affected systems, recommended response, and confidence score. NeMo Guardrails prevent hallucinated CVE IDs and incorrect severity scores. Every report is grounded in the actual telemetry retrieved by Agent 1, the attack chain computed by Agent 2, and the threat intelligence enriched by Agent 3. Analysts get a board-ready summary without writing a single line.
Agent in Action
Agent Performance
Mean Time to Respond (from hours)
Autonomous Resolution Rate
Attack Chain Reconstruction (H100)
NIM Agents (NeMo-orchestrated)
What Security Leaders Say
“Quellra agents resolved a ransomware lateral movement in under 3 minutes — correlation, attack chain reconstruction, blast radius assessment, and containment. Before our on-call analyst even opened their laptop.”
“The 6-agent NIM pipeline is the closest thing we've seen to an autonomous SOC. MTTR dropped from 4 hours to under 5 minutes. 90% of incidents need zero analyst time.”
RAPIDS, cuGraph, PyG on H100
Agent 1 runs RAPIDS cuDF joins on A10G for telemetry correlation. Agent 2 loads the correlated events into a Heterogeneous Graph Attention Network (HAN) and computes the most probable attack path in 200-500ms on H100 using cuGraph + PyG. The graph has 5 node types (user, device, process, network flow, file object) and outputs JSON: nodes, edges, actions, confidence. All other agents run on NVIDIA NIM microservices with TensorRT-optimized inference. The result: subsecond investigation and containment at wire speed.
Phase 2: RL Policy Optimizer + Federated Threat Sharing
Agent 7: RL Policy Optimizer learns optimal containment sequences from historical investigations. Agent 8: Cross-Customer Federated Threat Sharing surfaces anonymized signal embeddings across all Quellra customers — so your agents benefit from every attack seen by the entire fleet. All without exposing sensitive telemetry. Powered by NVIDIA FLARE for federated learning.
Deploythe6-AgentNIMPipeline
MTTR from hours to under 5 minutes. 90% autonomous resolution. No analyst required for 9 out of 10 incidents.