Autonomous Threat Mitigation in Multi-Project GCP Environments

Abstract

Traditional Security Operations Centers (SOC) face an "Inertia Gap"—the time between threat detection and manual firewall updates. Cybat AI introduces an agentic workflow using Gemini 2.5 Flash and GKE Autopilot to close this gap. This paper outlines the architecture for sub-5-second mitigation of L7 and L4 threats without human intervention.

1. The Ingestion Engine

Cybat AI utilizes Aggregated Logging Sinks at the Organization node. By routing all `GCE_Instance` and `HTTP_Load_Balancer` logs to a centralized Cloud Pub/Sub topic, we ensure complete visibility across the hierarchy.

2. AI-Driven Intent Analysis

Unlike static Regex-based WAFs, our Gemini-powered engine evaluates Contextual Intent. We analyze:

• Temporal Density: Frequency of 403 errors across multiple project IDs.
• Header Anomalies: Mismatched User-Agent strings and TCP fingerprinting.
• Lateral Movement: Identification of internal port-scanning patterns from compromised VMs.

3. Mitigation Strategy

MITRE ATT&CK mitigation is performed via two primary API paths:

4. Security & Compliance

Cybat AI operates on a Zero-Data-Retention basis. Logs are analyzed in-flight within a secure GKE sandbox. IAM permissions are managed via Workload Identity Federation, ensuring no static credentials ever exist within our infrastructure.