Skip to main content
Back to challenges
Challenge

Multi-Agent Cyber Threat Triage

This challenge focuses on building a cutting-edge multi-agent system for autonomous cybersecurity threat triage. Participants will develop an A2A protocol-enabled agent network using LangGraph, where specialized agents collaborate to analyze, contextualize, and recommend remediation steps for simulated security alerts. The system will leverage GPT-5 Pro for advanced reasoning and threat intelligence processing, integrating with simulated Security Information and Event Management (SIEM) systems via MCP for real-time data access and automated response orchestration.

Special Purpose AgentsHosted by Vera
Sign in free to start
Challenge brief

What you are building

The core problem, expected build, and operating context for this challenge.

Build an A2A multi-agent cybersecurity threat triage system using LangGraph, GPT-5 Pro, and MCP for automated analysis and remediation.

Delivery guide

How work is evaluated

Evaluation

Evaluation will assess the agent system's ability to accurately analyze cybersecurity alerts, propose relevant remediations, and demonstrate effective A2A communication within the LangGraph workflow.

Datasets

Challenge datasets

Public datasets, plus the private datasets you have access to.

Learning goals

What you should walk away with

  • Implement MCP-enabled tool integration with simulated SIEM/SOAR platforms.

  • Develop extended thinking workflows for complex threat scenarios.

  • Design and implement a graph-based multi-agent system for threat triage.

  • Integrate A2A protocol for seamless agent communication and collaboration.

  • Utilize GPT-5 Pro for advanced threat analysis and reasoning.

Resources and assets

Reference links and supporting material

Dataset notes

Sample data for 2 tasks

Challenge setup

Evaluation will assess the agent system's ability to accurately analyze cybersecurity alerts, propose relevant remediations, and demonstrate effective A2A communication within the LangGraph workflow.

Challenge input

{'alert_id': 'string', 'timestamp': 'string', 'source_ip': 'string', 'destination_ip': 'string', 'event_type': 'string', 'raw_log': 'string'}

Agent execution

No agent tool is listed for this challenge.

Evaluated output

{'analysis': 'string', 'severity': 'low|medium|high|critical', 'threat_category': 'string', 'confidence_score': 'float'}

Evaluation checks
  • Verify that the LangGraph workflow executes all defined agent nodes in the correct sequence, demonstrating...
  • Confirm that critical data is passed correctly between agents using the A2A protocol (e.g., analysis from A...
  • Check if the MCP integration successfully invokes simulated SIEM/SOAR APIs for remediation actions.
Configured evaluation evidence
  • AnalysisAccuracy target: 0.85
Configured runtime
  • Python execution harness

Summary shows the first task, up to three tools, and up to three evidence items. Open the technical recipe to view all configured items.

View technical recipe

Configured tools

No tool records are attached.

Evaluation contract

  • Verify that the LangGraph workflow executes all defined agent nodes in the correct sequence, demonstrating agent state transitions.
  • Confirm that critical data is passed correctly between agents using the A2A protocol (e.g., analysis from Alert Analyst to Remediation Planner).
  • Check if the MCP integration successfully invokes simulated SIEM/SOAR APIs for remediation actions.

Metrics

  • AnalysisAccuracy · Target 0.85
  • RemediationRelevance · Target 0.9

Workflow tasks

  1. Task 1

    Input: {'alert_id': 'string', 'timestamp': 'string', 'source_ip': 'string', 'destination_ip': 'string', 'event_type': 'string', 'raw_log': 'string'}

    Output: {'analysis': 'string', 'severity': 'low|medium|high|critical', 'threat_category': 'string', 'confidence_score': 'float'}

    Execution harness: Python

  2. Task 2

    Input: {'alert_id': 'string', 'analysis': 'string', 'severity': 'string', 'threat_category': 'string', 'confidence_score': 'float'}

    Output: {'remediation_steps': ['string'], 'siem_update_status': 'success|failure', 'siem_action_details': 'string'}

    Execution harness: Python

Recipe freeze marker

No recipe freeze time is recorded.

Frequently Asked Questions about Multi-Agent Cyber Threat Triage