Download as PDF, PPTX
Uploaded byCloud Village
The Rise of the Planet of the Agents: LLM-based AI Agents and Cloud Security APIs
The document discusses the application of LLM-based AI agents and MS Graph APIs in enhancing enterprise security, emphasizing their roles in incident analysis, data extraction, and the development of autonomous workflows. It outlines the concept of retrieval-augmented generation (RAG) and the agents' ability to think and act similarly to humans through reasoning and decision-making processes. Additionally, it highlights the integration of multi-agent approaches and the use of specific tools for interacting with Microsoft 365 data to improve security research capabilities.
More Related Content
Similar to The Rise of the Planet of the Agents: LLM-based AI Agents and Cloud Security APIs
The Rise of the Planet of the Agents: LLM-based AI Agents and Cloud Security APIs
- 1. LLM-BASED AI AGENTSAND CLOUD SECURITY APIS LLM-BASED AI AGENTS AND CLOUD SECURITY APIS
- 2. THE PRESENTATION/SLIDES/INFORMATION I SHARETODAY REPRESENT MY OWN PERSONAL VIEWS. I AM SPEAKING FOR MYSELF AND NOT ON BEHALF OF MY EMPLOYER, MICROSOFT CORPORATION AI CYBER SECURITY ENTHUSIAST
- 3. AGENDA ENTERPRISE SECURITY USECASES ENHANCED LLMS LLM-BASED AUTONOMOUS AGENTS AGENTIC WORKFLOWS MS GRAPH APIS FOR SECURITY MS GRAPH LLM-BASED AGENTS
- 4. ENTERPRISE SECURITY USECASES GENERATIVE AI APPLICATIONS
- 5. RESPONSE PROMPT EMBEDDINGS RELEVANT DOCUMENTS PROMPT EMBEDDING PROMPT INCIDENT ANALYSIS AND SUMMARIZATION DATAEXTRACTION AND KNOWLEDGE BUILDING CONVERSATIONAL ASSISTANTS LLM INCIDENTS / ALERTS / CODE SUMMARY / CONTEXT LLM UNSTRUCTURED DATA STRUCTURED DATA / GRAPH LLM SEARCH AND CONTEXTUAL RETRIEVAL THREAT REPORTS / MANUALS LLM CONTEXT STRUCTURED ANALYSIS ANALYST
- 6. KNOWLEDGE ENHANCED LLMS RETRIEVALAUGMENTED GENERATION (RAG)
- 7. KNOWLEDGEENHANCEDLLMS RESPONSE PROMPT LLM KNOWLEDGE “Incorporating knowledge into LLMscan empower their memorization and reasoning abilities for NLU and NLG” A SURVEY OF KNOWLEDGE ENHANCED PRE-TRAINED LANGUAGE MODELS HU ET AL. 2024
- 8. RETRIEVALAUGMENTEDGENERATION(RAG) PARAMETRIC KNOWLEDGE SOURCE KNOWLEDGE “A TECHNIQUE THATCOMBINES INFORMATION RETRIEVAL WITH TEXT GENERATION, ALLOWING A LANGUAGE MODEL TO USE EXTERNAL INFORMATION AS ADDITIONAL CONTEXT.”
- 9.
- 10.
- 11. LLM-BASED AUTONOMOUS AGENTS AIAGENTS THAT USE A LLM AS A REASONING ENGINE
- 12. AGENTS?AIAGENTS? AGENT ANYTHING THAT CANACT ON ITS OWN OR MAKE DECISIONS A COMPUTER PROGRAM OR MACHINE THAT CAN ACT ON ITS OWN, MAKING DECISIONS SIMILAR TO HOW HUMANS DO AI AGENT IT CAN USE TOOLS TO EXECUTE ACTIONS AND GATHER NEW INFORMATION, ENHANCING ITS DECISION-MAKING PROCESS
- 13. ARTIFICIAL INTELLIGENCE LLM-BASEDAGENTS USE ANLLM AS A REASONING ENGINE TO THINK IN NATURAL LANGUAGE. ACTIONS ARE NOT HARDCODED. COMBINE LANGUAGE-BASED PLANNING WITH ACTIONS! INTERACT WITH THE OUTSIDE WORLD IN A NON-DETERMINISTIC WAY, MUCH LIKE HOW HUMANS OPERATE.
- 14.
- 15. A REASONING ENGINE? THEPROCESS OF THINKING THROUGH A PROBLEM OR SITUATION LOGICALLY. IT'S HOW WE FIGURE THINGS OUT. THIS ABILITY CAN BE ACTIVATED BY A USER PROMPT LIKE 'THINK STEP BY STEP' ALSO BY PROVIDING EXAMPLES OF INTERMEDIATE REASONING STEPS. THIS APPROACH ENABLES THE AGENT TO BREAK DOWN A TASK INTO SMALLER PARTS AND METHODICALLY WORK THROUGH EACH STEP.
- 16.
- 17. ISREASONINGENOUGH? HOW WOULD ANAI AGENT INTERACT WITH THE REAL WORLD? HOW WOULD AN AGENT VALIDATE ITS REASONING? HOW WOULD AN AGENT LEARN NEW THINGS FROM ITS ENVIRONMENT? CAN IT REASON REACTIVELY OR UPDATE ITS KNOWLEDGE? AN AGENT NEEDS TO DO MORE THAN JUST THINK; IT NEEDS TO ACT.
- 18. ENTERREACT(REASON🧠+ACT⚡️)! Thought: Agent analyzesthe situation and generates a thought. Action: Based on the thought, the agent takes an action. Observation: After acting, the agent observes the outcome to assess the impact and effectiveness. ILLUSTRATION SHOWING THE INTERSECTION OF REASON AND ACT. (SOURCE: YAO ET AL. 2023).
- 19.
- 20. ARTIFICIAL INTELLIGENCE TOOLS->USINGFUNCTIONCALLING Enables modelsto Output JSON (structured output) Detect when a function should to be called Output JSON that matches a function signature
- 21. ARTIFICIAL INTELLIGENCE ARTIFICIAL INTELLIGENCE CHATCOMPLETION PAYLOAD USER MESSAGE TOOLS jump get_weather ASSISTANT MESSAGE TOOL CALLS TOOL MESSAGE ASSISTANT MESSAGE 1 WHAT IS THE WEATHER IN VIRGINIA? LLM id: call_12345xyz name: get_weather arguments: {"location":"virginia”} USER tool_call_id: call_12345xyz name: get_weather content: “virginia: 80 F”. THE WEATHER IN VIRGINIA IS 80 F. LLM LLM LLM AI AGENT USER 2 3 4 AI AGENT
- 22. MODELS&FUNCTIONCALLING Models that Supportfunction Calling OpenAI Models Mistral AI Models Anthropic Claude Google Gemini For models without Function Calling, we use prompt engineering to add decision-making logic directly into the prompts.
- 23. ARTIFICIAL INTELLIGENCE TOOLS->SELECT THERIGHTTOOL VIAPROMPTING LLM GREET("HELLO, ROBERTO!HOW CAN I ASSIST YOU TODAY?") YOU HAVE ACCESS TO THE FOLLOWING TOOLS: SEARCH(TOPIC: STR) - USE IT TO SEARCH INFORMATION. GREET(PERSON: STR) - USE IT TO GREET A PERSON. RESPOND TO THE THE USER WITH THE RIGHT TOOL AND INPUT WHENEVER IS NEEDED.WHEN RESPONDING TO THE USER, PROVIDE ONLY ONE TOOL PER $JSON_BLOB, AS SHOWN: ``` {{ "NAME": $TOOL_NAME, "ARGUMENTS": $INPUT }} ``` USER INPUT: HELLO, MY NAME IS ROBERTO! {'NAME': 'GREET', 'ARGUMENTS': 'ROBERTO!'} USER MESSAGE ASSISTANT MESSAGE
- 24. AGENTICAPPROACH ADVANCE RAG TOOL VIRUS TOTAL TOOL REPORTING TOOL AGENT TOOLUSE PLANNING MEMORY REFLECTION RESPONSE
- 25.
- 26. ARTIFICIAL INTELLIGENCE MULTI-AGENTTASKSOLVERS RESPONSE PROMPT AGENT 1 SOCMANAGER AGENT 2 SOC ANALYST AGENT 3 TI ANALYST AGENT 4 REPORT WRITER Specialized Agents Multi-model Workflow Parallelization Full Autonomy vs Deterministic Workflows Agents as Micro-services
- 27. AGENTIC WORKFLOWS ORCHESTRATING TASKSWITH LLM-BASED AI AGENTS
- 28. WORKFLOWS? ORCHESTRATES TASKS MAINTAINS STATEOVER TIME HANDLES FAILURES GRACEFULLY INTEGRATES MULTIPLE SERVICES
- 29. USER WORKFLOW EXAMPLE MESSAGE USER CreateAAD App, Add Secret to App, grant permissions to read mail and then read mail from User X. USER MS GRAPH API CREATE-APP ADD-SECRET GRANT PERMISSIONS AUTH-AS-APP READ-MAIL -------------- -------------- -------------- -------------- -------------- -------------- -------------- -------------- -------------- -------------- -------------- --------------
- 30. ORCHESTRATOR APP ADMINISTRATOR ORCHESTRATOR USER USERMESSAGE Create AAD App, Add secret to app, grant permissions to read mail and then read mail from User X. USER MESSAGE Create AAD App USER MESSAGE AAD App was created ... ORCHESTRATOR APP ADMINISTRATOR USER MESSAGE Add Secret to AAD APP ORCHESTRATOR APP ADMINISTRATOR USER MESSAGE secret was created, here it is ... APP ADMINISTRATOR ORCHESTRATOR USER MESSAGE Here are the top 25 email... USER ADMINISTRATOR .......... ..... AGENTIC WORKFLOW
- 31. AGENTIC PATTERNS SEQUENTIAL /TASK CHAINING CONVERSATIONAL GROUP CHAT
- 32.
- 33.
- 34.
- 35. MS GRAPH APIFOR SECURITY SECURITY RESEARCHERS IN OFFENSE AND DEFENSE
- 36. ARTIFICIAL INTELLIGENCE MSGRAPHAPI Gateway toMicrosoft 365 data Access to Cloud Services Centralized API Endpoint Build Intelligent Apps HTTPS://LEARN.MICROSOFT.COM/EN-US/GRAPH/OVERVIEW
- 37. ARTIFICIAL INTELLIGENCE LISTINCIDENTS GET /security/incidents/{incidentId} Getsthe properties and relationships of an incident object. Incidents can be correlated with alert objects. HTTPS://LEARN.MICROSOFT.COM/EN-US/GRAPH/OVERVIEW
- 38. A post-exploitation toolsetto interact with the MS Graph API. It provides various tools for performing reconnaissance, persistence, and pillaging of data from a Microsoft Entra ID (Azure AD) account. HTTPS://GITHUB.COM/DAFTHACK/GRAPHRUNNER/
- 39. MS GRAPH LLM-BASEDAGENTS AGENTS WITH ACCESS TO MS GRAPH API SPECIFICATIONS
- 40. RESPONSE PROMPT LLM ACTION TOOLS REASONING PLANNING OBSERVATION USER MS GRAPH API AI AGENT OPENAI FUNCTIONS OPEN API SPECIFICATIONS MS ENTRA ID THESINGLEAGENTIDEA>TOOLCALLS
- 41.
- 42. RESPONSE PROMPT LLM ACTION TOOLS REASONING PLANNING OBSERVATION USER MS GRAPH API AIAGENT MS ENTRA ID THESINGLEAGENTIDEA>RAG RAG OPEN API SPECIFICATIONS OPEN AI FUNCTIONS
- 43. OPEN API SINGLEAGENT REACT MS GRAPH OPEN API SPECIFICATIONS
- 44. OPEN API MULTI-AGENTREACT MS GRAPH OPEN API SPECIFICATIONS
- 45.