Architecting an AI Agent System for Security Event Investigation
This article details Datadog's approach to building Mambark, an AI agent system designed for efficient security event investigation. It focuses on using a small state-space model to filter and prioritize security events, enabling more resource-intensive AI agents to focus only on critical alerts, thereby optimizing operational costs and improving detection accuracy in a large-scale data environment.
Read original on Datadog BlogThe Challenge of AI-Powered Security Event Analysis at Scale
Investigating every security event with large AI models (LLMs) is prohibitively expensive and inefficient due to the sheer volume of data generated by modern systems. The core challenge lies in building a system that can accurately identify high-priority security events for deeper AI analysis while keeping operational costs manageable. This requires an intelligent filtering layer that can distinguish signal from noise before engaging more complex and costly AI agents.
Introducing Mambark: A Two-Tiered AI Architecture
Datadog addressed this by developing Mambark, a system employing a two-tiered AI architecture. The first tier uses a small, efficient state-space model to score and filter incoming security events in real-time. This initial layer acts as a 'gatekeeper', passing only the most relevant events to a more powerful, general-purpose AI agent for in-depth investigation. This design significantly reduces the computational load and associated costs compared to running large AI models on every event.
System Design Implication: Cost-Effective AI Integration
This architectural pattern of using a smaller, specialized model for initial filtering before engaging a larger, more general-purpose (and costly) AI agent is a powerful strategy for integrating AI into high-volume, real-time systems. It allows for leveraging advanced AI capabilities without incurring 'frontier' costs for every single data point.
Key Architectural Components and Data Flow
- Event Ingestion: Security events are continuously ingested into the system, likely through a high-throughput streaming platform.
- Mambark Model (First Tier): This lightweight model processes each event, calculates a relevance score, and filters out irrelevant noise. It operates at a high velocity to keep up with the data stream.
- Event Queue/Buffer: Filtered, high-score events are placed into a queue, awaiting processing by the more powerful AI agent. This decouples the processing stages and handles backpressure.
- General-Purpose AI Agent (Second Tier): This agent picks events from the queue and performs deep analysis, correlating information, and generating investigation summaries or actions. This agent can be an LLM or a more complex analytical engine.
The success of this system relies on the accuracy and efficiency of the Mambark model in the first tier. Its ability to correctly identify truly relevant security events is paramount to ensure that critical alerts are not missed, while also effectively controlling the costs of the subsequent, more resource-intensive AI analysis.