Designing a Multi-Agent AI SOAR System for Real-Time SIEM Triage and Incident Response

Security Operations Centers (SOCs) are increasingly overwhelmed by alert fatigue, and static, rule-based SOAR playbooks struggle against attackers who adapt their techniques to bypass known signatures. This paper presents the design and proof-of-concept implementation of a hybrid SIEM/SOAR ecosystem that removes the human bottleneck from routine threat triage. Alerts generated by Wazuh EDR are orchestrated through n8n, deduplicated via a Redis-based cache in the target architecture, and enriched in parallel through four independent OSINT sources (VirusTotal, AbuseIPDB, IPinfo, and AlienVault OTX). The core contribution is a two-model AI consensus layer, in which Google Gemini Pro acts as a first-tier analyst and OpenAI GPT-4o is deliberately prompted to act as an adversarial reviewer, challenging the initial verdict before any containment action is taken. Confirmed threats trigger simultaneous blocking at the network edge (Cloudflare WAF) and host level (UFW/iptables), alongside multi-channel alerting and centralized SIEM telemetry. The architecture additionally defines a target self-healing layer for affected hosts and incorporates a fail-safe layer to prevent alert loss during third-party API outages. We discuss the system's operational constraints — API rate limits, token cost, and network latency — and outline a roadmap toward Zero Trust integration and deception-based defense.