AI Agents

Autonomous Security Agents. No Analyst Required.

6-agent NIM pipeline orchestrated by NeMo planner with chain-of-thought reasoning. MTTR from hours to under 5 minutes. 90% autonomous resolution. Attack chain reconstruction in 200-500ms on H100. Pre-approved containment across firewall, EDR, IdP, and OT.

1

Ingest & Detect

Morpheus + TensorRT

2M+ events/sec processed through NVIDIA Morpheus. TensorRT INT8 inference scores every event in under 0.4ms.

2

Correlate & Reconstruct

RAPIDS cuDF + cuGraph

Telemetry correlation via cuDF joins. HAN GNN reconstructs attack chains across 5 entity types in 200-500ms.

3

Assess & Report

NeMo LLM + Guardrails

Blast radius prediction identifies hosts at risk. NeMo generates SOC-ready investigation report with confidence scores.

4

Contain & Respond

NIM Microservices

Pre-approved playbooks execute containment — isolate hosts, revoke credentials, block IPs. Auditable and reversible.

Agent Capabilities

Agent 1: Telemetry Correlation

Queries RAPIDS-backed telemetry lake (cuDF joins across endpoint, network, identity, cloud). Retrieves all events correlated with flagged entity within configurable time window. Runs on A10G GPU.

Agent 2: Attack Chain Reconstruction

Loads correlated events into HAN (Heterogeneous Graph Attention Network). cuGraph + PyG on 5 node types: user, device, process, network flow, file object. Computes most probable attack path in 200-500ms on H100.

Agent 3: Threat Intelligence Enrichment

Maps observed TTPs to MITRE ATT&CK technique IDs. Queries CISA KEV for known exploited CVEs, FS-ISAC sector-specific feeds. NeMo Retriever-backed RAG pipeline.

Agent 4: Blast Radius Assessment

Projects lateral movement risk using predictive model. Identifies hosts at >80% probability of compromise in next 15 minutes based on network reachability and behavioral similarity.

Agent 5: Report Generation

NeMo LLM (Llama-3-based, fine-tuned on SOC incident reports). NeMo Guardrails prevent hallucinated CVE IDs and incorrect severity scores. Outputs: executive summary, timeline, attack chain diagram, affected systems, recommended response, confidence.

Agent 6: Response Execution

Pre-approved containment via firewall (Palo Alto/Fortinet), EDR (CrowdStrike/SentinelOne), IdP (Okta/Entra ID), OT (Quellra Edge PLC isolation). All actions logged with timestamps, confidence scores, reversibility flags. Risk-scored, auditable, reversible.

Orchestration

NeMo Planner with Chain-of-Thought Reasoning

Every investigation is orchestrated by NVIDIA NeMo planner with chain-of-thought reasoning. The planner sequences the 6-agent NIM pipeline, passing outputs from one agent as inputs to the next: telemetry correlation → attack chain reconstruction → threat intel enrichment → blast radius assessment → report generation → response execution. Each agent runs on NVIDIA NIM microservices with TensorRT-optimized inference. GPU acceleration on A10G and H100 drives subsecond graph inference and real-time containment.

Agent API

investigate.ts
import { Quellra } from "@quellra/sdk"; const client = new Quellra({ apiKey: process.env.QUELLRA_KEY }); // Launch 6-agent NIM pipeline (NeMo planner orchestrates)const investigation = await client.agents.investigate({  trigger: "alert:lateral-movement-detected",  scope: {    assets: ["srv-prod-*", "endpoint-finance-*"],    timeWindow: "last_4h",  },  pipeline: [    "telemetry_correlation",    // Agent 1: RAPIDS-backed cuDF joins    "attack_chain_reconstruction", // Agent 2: HAN (cuGraph + PyG on H100)    "threat_intel_enrichment",  // Agent 3: MITRE ATT&CK + CISA KEV + FS-ISAC    "blast_radius_assessment",  // Agent 4: Predictive lateral movement risk    "report_generation",        // Agent 5: NeMo LLM + Guardrails    "response_execution",       // Agent 6: Firewall + EDR + IdP + OT  ],  escalation: {    threshold: "critical",    channel: "pagerduty",  },}); console.log(investigation.id);           // "inv_8x2kLm9..."console.log(investigation.status);       // "containing"console.log(investigation.attackChainMs); // 487 (H100 graph inference)

Measurable Outcomes

MTTR < 5 Minutes

Mean time to respond drops from hours to under 5 minutes. 6-agent NIM pipeline orchestrated by NeMo planner with chain-of-thought reasoning investigates and contains autonomously.

90% Autonomous Resolution

Nine out of ten incidents resolved without human intervention. Agents handle the entire pipeline: correlation → reconstruction → enrichment → blast radius → report → containment.

<500ms Attack Chain

Heterogeneous Graph Attention Network (HAN) computes most probable attack path in 200-500ms on H100. cuGraph + PyG on 5 node types. JSON output with confidence scores.

Risk-Scored, Auditable, Reversible

Every containment action logged: timestamp, confidence score, reversibility flag. Pre-approved playbooks across firewall, EDR, IdP, and OT. Full forensic trail.

Agent 5: Report Generation

NeMo LLM + Guardrails: Zero Hallucinations

Agent 5 uses NeMo LLM (Llama-3-based, fine-tuned on 10,000+ SOC incident reports) to generate executive summary, timeline, attack chain diagram, affected systems, recommended response, and confidence score. NeMo Guardrails prevent hallucinated CVE IDs and incorrect severity scores. Every report is grounded in the actual telemetry retrieved by Agent 1, the attack chain computed by Agent 2, and the threat intelligence enriched by Agent 3. Analysts get a board-ready summary without writing a single line.

Agent in Action

Terminal
quellra agents status --investigation inv_8x2kLm9
Investigation: inv_8x2kLm9
Status: RESOLVED (autonomous)
Duration: 4m 12s
6-Agent NIM Pipeline (NeMo planner orchestration):
[1] Telemetry Correlation 0:18s ✓ RAPIDS cuDF joins (A10G)
[2] Attack Chain Reconstruction 0:23s ✓ HAN inference 487ms (H100)
[3] Threat Intel Enrichment 0:34s ✓ MITRE T1078.004 + CISA KEV-2024-0812
[4] Blast Radius Assessment 0:41s ✓ 3 hosts &gt;80% lateral risk (next 15min)
[5] Report Generation 1:58s ✓ NeMo LLM + Guardrails (no hallucinations)
[6] Response Execution 4:12s ✓ Firewall + EDR + IdP containment
Actions Taken (all logged with confidence + reversibility):
• Isolated host srv-prod-07 (CrowdStrike contain API)
• Revoked service account creds (Okta session revoke)
• Blocked egress to 45.33.x.x (Palo Alto IP deny rule)
Attack Chain (JSON):
{"nodes": ["user:svc_finance", "host:srv-prod-07", "process:powershell.exe", ...],
"edges": ["Valid Accounts", "Lateral Tool Transfer", ...], "confidence": 0.94}
Blast Radius: 3 assets, 0 data exfiltrated, 0 lateral movement succeeded
MTTR: 4m 12s (from alert to full containment)
Escalation: None required (resolved autonomously)

Agent Performance

0min

Mean Time to Respond (from hours)

0%

Autonomous Resolution Rate

0ms

Attack Chain Reconstruction (H100)

0

NIM Agents (NeMo-orchestrated)

What Security Leaders Say

Quellra agents resolved a ransomware lateral movement in under 3 minutes — correlation, attack chain reconstruction, blast radius assessment, and containment. Before our on-call analyst even opened their laptop.

Marcus ChenVP of Security Operations, Meridian Financial

The 6-agent NIM pipeline is the closest thing we've seen to an autonomous SOC. MTTR dropped from 4 hours to under 5 minutes. 90% of incidents need zero analyst time.

Sarah OkaforCISO, NovaTech Industries
GPU Acceleration

RAPIDS, cuGraph, PyG on H100

Agent 1 runs RAPIDS cuDF joins on A10G for telemetry correlation. Agent 2 loads the correlated events into a Heterogeneous Graph Attention Network (HAN) and computes the most probable attack path in 200-500ms on H100 using cuGraph + PyG. The graph has 5 node types (user, device, process, network flow, file object) and outputs JSON: nodes, edges, actions, confidence. All other agents run on NVIDIA NIM microservices with TensorRT-optimized inference. The result: subsecond investigation and containment at wire speed.

Future

Phase 2: RL Policy Optimizer + Federated Threat Sharing

Agent 7: RL Policy Optimizer learns optimal containment sequences from historical investigations. Agent 8: Cross-Customer Federated Threat Sharing surfaces anonymized signal embeddings across all Quellra customers — so your agents benefit from every attack seen by the entire fleet. All without exposing sensitive telemetry. Powered by NVIDIA FLARE for federated learning.

Deploythe6-AgentNIMPipeline

MTTR from hours to under 5 minutes. 90% autonomous resolution. No analyst required for 9 out of 10 incidents.