SherAgent: LLM-empowered iterative query-filter backtracking to scale attack investigation in real environments

SherAgent is an LLM-empowered automated attack investigation system whose end-to-end investigation success rate in real-environment evaluations improves by 31.1% and 63.7% over traditional enterprise baselines and SOTA, respectively. It iteratively performs "query-filter" backtracking over provenance graphs, dynamically calibrating query conditions to cope with broken causal chains, and uses filtering and node selection to mitigate dependency explosion, with each investigation costing less than $0.10 in API cost and taking less than 4 minutes.