Search papers, labs, and topics across Lattice.
This paper introduces STAIR, an end-to-end agentic planning framework designed to enhance incident response in compromised software systems. By representing the current incident as a Graph-as-State and utilizing stage-specialized agents for planning, STAIR effectively adapts to dynamic incident conditions and incorporates historical experiences to inform decision-making. The framework demonstrated a significant improvement in performance, achieving a normalized defense score of 0.94 across 100 Docker-based cyber ranges, outperforming the strongest baseline by 9.5%.
STAIR transforms incident response by leveraging a dynamic Graph-as-State representation and specialized agents, achieving a remarkable 9.5% improvement over traditional methods.
Incident response planning is critical for restoring compromised software systems after cyberattacks. Common practice relies on expert-driven playbooks that encode fixed response procedures, but these static workflows struggle to adapt to evolving incident states, changing recovery objectives, and execution feedback. Recent LLM-based planners and tool-using agents improve automation, yet they remain unstable in long-horizon response because they lack a unified basis for maintaining incident state, aligning actions with the current recovery stage, and reusing historical experience. We present STAIR, an end-to-end agentic planning framework for incident response. The framework maintains the current incident as Graph-as-State, uses a Stage Router to dispatch planning to stage-specialized agents, and retrieves historical experiences to guide action selection. An Execution Harness executes actions, returns feedback to update the incident state, and validates action effects for future experience reuse. Across 100 Docker-based cyber ranges, our framework achieves a normalized defense score of 0.94 and improves over the strongest baseline by 9.5%.
