GraphGuard
A cybersecurity investigation system built on graph databases and AI agents. It converts security alerts into traceable attack graphs to enable rapid threat investigation.
Timeline (last 90 days)
The GraphGuard project combines the graph database FalkorDB with an AI agent based on Gemini and LangChain for cybersecurity investigations.
GraphGuard claims to cut security incident investigation time from hours to seconds.
GraphGuard's data model contains 8 types of nodes: User, Device, IPAddress, Alert, Incident, Service, Investigation, and Evidence.
GraphGuard's data model contains 10 relationship types: USES, CONTACTED, TRIGGERED, ASSOCIATED_WITH, PART_OF, AFFECTS, INVOLVED_IN, EXAMINED, USED_EVIDENCE, and SUPPORTS.
The GraphGuard database comes preloaded with 27 base entities and 28 relationships, covering three real scenarios (a multi-hop intrusion chain, a financial credential attack, and a benign baseline).
GraphGuard includes a built-in library of more than 20 parameterized Cypher queries, of which three, including TRACE_INCIDENT_PATH, form the pillars of the investigation engine.
GraphGuard persists completed investigations and evidence as first-class nodes (Investigation, Evidence) in FalkorDB, enabling cross-session agent memory.
In GraphGuard investigations, the AI agent must execute 5-7 sequential graph queries to discover neighbors and attack paths.
All Facts (8)
The GraphGuard project combines the graph database FalkorDB with an AI agent based on Gemini and LangChain for cybersecurity investigations.
50%UnverifiedGraphGuard claims to cut security incident investigation time from hours to seconds.
50%UnverifiedGraphGuard's data model contains 8 types of nodes: User, Device, IPAddress, Alert, Incident, Service, Investigation, and Evidence.
50%UnverifiedGraphGuard's data model contains 10 relationship types: USES, CONTACTED, TRIGGERED, ASSOCIATED_WITH, PART_OF, AFFECTS, INVOLVED_IN, EXAMINED, USED_EVIDENCE, and SUPPORTS.
50%UnverifiedThe GraphGuard database comes preloaded with 27 base entities and 28 relationships, covering three real scenarios (a multi-hop intrusion chain, a financial credential attack, and a benign baseline).
50%UnverifiedGraphGuard includes a built-in library of more than 20 parameterized Cypher queries, of which three, including TRACE_INCIDENT_PATH, form the pillars of the investigation engine.
50%UnverifiedGraphGuard persists completed investigations and evidence as first-class nodes (Investigation, Evidence) in FalkorDB, enabling cross-session agent memory.
50%UnverifiedIn GraphGuard investigations, the AI agent must execute 5-7 sequential graph queries to discover neighbors and attack paths.
50%