Building a Multi-Agent Cybersecurity Investigation System with…

Hi everyone!

I wanted to share some of the engineering work behind a project we developed called ThreatLens AI, as part of Team Dynamic Kicks.

Rather than building a traditional chatbot that simply analyzes security logs, we explored how multiple specialized AI agents could collaborate throughout a cybersecurity investigation.

1. Why a multi-agent approach?

We divided the investigation workflow into five specialized agents:

Threat Detection Agent: Uses deterministic security rules and LLM-assisted interpretation to identify suspicious activity.
Investigation Agent: Examines evidence, constructs incident timelines, and identifies investigation findings.
Hindsight Memory Agent: Retrieves relevant knowledge from previous investigations.
Response Recommendation Agent: Generates defensive recommendations that require analyst approval.
Learning Agent: Retains analyst-confirmed outcomes for future investigations.

An AgentCoordinator manages the workflow.

2. The interesting engineering part: Persistent memory

One of the main things we wanted to explore was how an investigation could benefit from previous verified incidents.

We integrated Hindsight to support this workflow:

Process and investigate the first credential-related incident.
Have an analyst review and confirm the findings.
Retain the verified outcome in memory.
Process a similar second incident.
Retrieve relevant historical knowledge to inform the investigation.

This creates a workflow where previous investigation experience can contribute to future analysis.

3. Technology stack

Frontend: React, Vite, JavaScript, Tailwind CSS
Backend: Python, FastAPI
LLM integration: Groq
Database: MongoDB
Persistent memory: Hindsight

4. Engineering considerations

Some important aspects we considered during development:

Separating agent responsibilities.
Coordinating the investigation workflow.
Distinguishing observed evidence from AI-generated hypotheses.
Keeping human analysts involved in knowledge retention and response approval.
Separating operational incident data from persistent memory.

5. What we learned

The biggest takeaway was that building a multi-agent application involves much more than calling an LLM several times.

The orchestration layer, data consistency, memory retrieval, error handling, and human oversight are equally important.

We're continuing to validate and improve ThreatLens AI.

GitHub: https://github.com/Ramithagolla/Dynamic-kicks

I'd be interested in hearing from developers working with agentic systems:

How do you approach memory management in multi-agent applications? Do you prefer a shared memory layer or separate memory for each agent?

Thanks for reading!

https://preview.redd.it/ai1yuk5k900i1.jpeg?width=1912&format=pjpg&auto=webp&s=157e946cc7afbff0cb285a74b795e95881408cd1

https://preview.redd.it/72wxwn5k900i1.jpeg?width=1912&format=pjpg&auto=webp&s=0a3b9ba347cc1b8780cc6e38491d5e5a878389d8

https://preview.redd.it/creaam5k900i1.jpeg?width=1912&format=pjpg&auto=webp&s=22957bdabe3bb2d2bce4f555ea8d56dd5dc01af3

https://preview.redd.it/62kplp5k900i1.jpeg?width=1912&format=pjpg&auto=webp&s=a1ed8e61972a5bd26f39f506e44d494d57f207ec

Impact

The system aims to improve cybersecurity investigations by enabling AI agents to collaborate and learn from past incidents, potentially increasing the efficiency and accuracy of threat detection and response recommendations. There is no indication of a security vulnerability or threat posed by the system itself. The impact is positive in terms of enhancing security operations through AI-assisted investigation workflows with persistent memory and human oversight.

Defensive guidance

No mitigation is required as this is not a vulnerability or active threat. The system is a cybersecurity tool designed to assist analysts. Users should ensure proper configuration and secure handling of API keys and data, as recommended in the project documentation, but no specific security issues are reported.

Summary

ThreatLens AI employs a five-agent pipeline comprising Threat Detection, Investigation, Hindsight Memory, Response Recommendation, and Learning agents coordinated to process security logs, identify suspicious activity, build incident timelines, recall historical incident knowledge, and generate defensive recommendations. Persistent memory is implemented via the Hindsight SDK to retain analyst-confirmed investigation outcomes, enabling the system to leverage past incident knowledge in future investigations. The system architecture separates operational incident data from persistent memory and maintains human analyst involvement for oversight and approval. The technology stack includes React frontend, Python FastAPI backend, Groq LLM integration, MongoDB database, and Hindsight for persistent memory. The system is designed as an investigative aid rather than an automated response tool.

Building a Multi-Agent Cybersecurity Investigation System with Persistent Memory

Discussion

1. Why a multi-agent approach?

2. The interesting engineering part: Persistent memory

3. Technology stack

4. Engineering considerations

5. What we learned

Links cited in the discussion

Impact

Defensive guidance

Summary

References

Community reviews

Discussion

1. Why a multi-agent approach?

2. The interesting engineering part: Persistent memory

3. Technology stack

4. Engineering considerations

5. What we learned

Links cited in the discussion

AI analysisMachine-generated, updated 13 Nov 2026, 01:39 UTC

Technical details

References

Community reviews

Related threats