Correlating Weak Signals Paged a Synthetic Agentic Intrusion Before Any Secret Was Read

The main gap is positioning. This is risk-based alerting, and Splunk Enterprise Security ships both key mechanisms as default correlation searches — "ATT&CK Tactic Threshold Exceeded" fires on tactic_count >= 3 AND source_count >= 4, which is the diversity bonus, and dc(tactic) is category deduplication. Sentinel, Exabeam, and Chronicle have equivalents. No related work engages with any of it, so a reader from a SOC will see apparent reinvention.

Both headline metrics are constructed. TPR 1.000 is guaranteed by scenario design; FPR 0.100 is the fraction of benign variants deliberately built to be hard; the 106 seconds depends on where severity labels were placed. The limitations acknowledge the general problem but should connect it to these specific numbers.

The paper tackles the right gap: in the real incident the signals were correlated but nobody was paged. The ablations are honest and they show the diversity bonus causes both the 106-second gain and all six false pages, and that the rate bonus does nothing.

This project presents a clear and auditable feasibility test for an important incident-response question: can correlation of distinct weak signals page a responder before a sensitive action, rather than waiting for one event to become high severity? The strongest result is the explicit operating tradeoff. In the constructed harness, AgentPage detects all 30 attack variants an average of 106 seconds earlier than high-severity paging and before the first secret-access event, but it produces six false pages across 60 benign variants; removing the diversity bonus removes those false pages but also removes the timing advantage. The category-deduplication ablation is also useful, showing that repeated benign inventory signals can otherwise inflate risk as if they were independent evidence. The key limitation is that the detector and all scenario labels, timing distributions, weights, thresholds, and variants were hand-designed by the same author, so the reported 100% TPR and 10% FPR describe this synthetic harness rather than expected production performance. The most important next step is evaluation on independently collected, normalized telemetry with separate tuning and test sets, more realistic class imbalance and alert-volume costs, cross-host correlation, delayed or missing telemetry, and comparisons with additional sequence-aware correlation baselines.