STAIR: Effective Incident Response Using an End-to-End Agentic Planning Framework

Abstract

Incident response planning is critical for restoring compromised software systems. Existing AIOps methods automate fault diagnosis and remediation and adapt response using feedback, but lack a unified decision basis across planning and execution. This limits their ability to maintain incident state and align actions with evolving recovery objectives during long-horizon, multi-stage security incident response. We present STAIR, an end-to-end agentic response framework that organizes planning and execution around a shared incident state. STAIR maintains incident evidence, response actions, and execution feedback in Graph-as-State (GAS), using the latest state to determine the response stage and recovery objectives for stage-specialized planning. The framework retrieves effect-validated historical experience based on the current state and stage to guide action selection. An Execution Harness executes actions, returns feedback to update GAS, and validates action effects for future experience reuse. We construct STAIR-Bench, an executable incident response benchmark comprising 44 Docker-based cyber-range cases. On its held-out test cases, STAIR achieves an overall defense score of 0.95, improving over the strongest baseline by approximately 10.47%. In the independent CAGE4 environment with ongoing attacks and benign activity, STAIR reduces cumulative penalties by approximately 28.8% relative to the strongest baseline.