# LogRESP-Agent: A Recursive AI Framework for Context-Aware Log Anomaly Detection and TTP Analysis
## 3 Proposed Method
### Recursive Reasoning Framework for Log Analysis
**Summary**: A high-level decision that characterizes the event as benign, suspicious, or indicative of an attack. 2. **Evidence**: A focused set of key observations that played a central role in guiding the agent's assessment. 3. **Reasoning Trace**: A chronological outline of the agent's investigative steps, detailing the sequence of tool invocations and the conclusions drawn at each stage. 4. **Mapped Threat Context (if any)**: Behavioral correlations to known adversarial techniques, such as MITRE ATT&CK tactics, malware families, or threat actor patterns. \begin{table}
\begin{tabular}{c c c c} \hline \hline
**Scenario** & \multicolumn{2}{c}{**Agent Behavior**} & \multicolumn{2}{c}{**Final Output**} \\ \hline Attack & \(\bullet\) & Aggregate anomaly indicators & Identifies associated MITRE ATT&CK TTP(s) and describes supporting evidence in a structured explanation \\  & \(\bullet\) & Cross-validate with TTP patterns & Identifies associated MITRE ATT&CK TTP(s) and describes supporting evidence in a structured explanation \\ \hline Benign & \(\bullet\) & Review contextual consistency & Explains why the event is benign (e.g., scheduled task, admin script), referencing safe patterns or known whitelist behaviors \\  & \(\bullet\) & Confirm benign justification & \\ \hline Ambiguous /Low Confidence & \(\bullet\) & Detect insufficient or conflicting signals & Continues reasoning or outputs “inconclusive” with explanation of missing context or low-confidence factors \\  & \(\bullet\) & Identify missing context & Continues reasoning or outputs “inconclusive” with explanation of missing context or low-confidence factors \\ \hline \hline \end{tabular}
\end{table} 
Table 3: Reasoning Paths and Final Output Structure. By generating natural language explanations grounded in both evidence and reasoning history, the system ensures not only interpretability and auditability but also operational usability. Each explanation captures what the agent observed, how it reasoned through multiple tools, and why it reached a particular conclusion--providing downstream analysts or automated response systems with the necessary context to validate, replicate, or act upon the results with confidence. ## 4 Implementation

To evaluate the practical utility of the proposed LangChain-based Security Agent, we conducted a series of experiments designed to assess both detection performance and explanation quality. Specifically, the evaluation focused on two key classification tasks: (1) Anomaly Detection of log entries as normal or malicious, and (2) Multi-class classification of malicious samples into specific attack types. In addition to performance metrics, we also analyzed the interpretability of the agent's outputs by examining its reasoning traces and final explanations. The following subsections detail the datasets used (Section 4.1), overall implementation setup including baseline methods (Section 4.2), detection results (Section 4.3), interpretability evaluation of the agent's reasoning process (Section 4.4), and an ablation study on tool-level contributions to detection accuracy (Section 4.5). ### Datasets

We employed two datasets to support the anomaly detection and multi-class classification tasks of our experiments. The first dataset consists of endpoint process logs collected from a live enterprise environment, offering realistic benign and malicious activity patterns. The second dataset was curated from a publicly available repository of Windows attack logs, annotated with MITRE ATT&CK tactics. Each dataset was used for a distinct evaluation purpose. The detailed distribution of both datasets is summarized in Table 4.