Built an autonomous SOC investigation platform that compresses a 4-hour manual analyst investigation into ~100 seconds. 6 specialized LangGraph agents (Triage, Reconstruction, ThreatIntel, TTP, Synthesis, Report) run a ReAct kill-chain loop over Splunk Enterprise's botsv3 dataset (2M+ events), with MITRE ATT&CK RAG retrieval (697 techniques via Qdrant), MLTK-native AI validation, a 3-layer SPL guardrail, SHA-256 audit chain, containment planning with SSE execution, detection gap analyzer, and Langfuse PromptOps. 425 tests passing