Clouseau: A Hierarchical Multi-Agent Approach for Autonomous Attack Investigation

Cyberattack investigations are crucial for understanding the Tactics, Techniques, and Procedures of adversaries, but they face increasing challenges due to the complexity, scale, and volume of modern cyber incidents. Current approaches, such as heuristic-based and learning-based methods, struggle with scalability and reliance on labeled data, leading to difficulties in adapting to new threats. In this paper, we present Clouseau,a hierarchical multi-agent approach that leverages the reasoning capabilities of Large Language Models (LLMs) to autonomously investigate cyberattacks from a single Point-Of-Interest while requiring neither prior training nor predefined heuristics. We evaluated Clouseauon 21 diverse attack scenarios, including complex cases from DARPA's OpTC engagements and Advanced Persistent Threat (APT) attack scenarios from the ATLAS dataset. In single-host settings, Clouseauachieves an average F1 score of 99.78%, surpassing strong baselines by more than 33%. To demonstrate its broad applicability, we tested Clouseau with both proprietary and open-weight LLMs, achieving strong performance in both cases, thereby enabling deployment in private environments where access to proprietary models is restricted.