Hands-on workshop examples for exploring how Large Language Models and AI agents can support security operations in telecommunications environments.
The repository progresses from single-LLM security workflows to tool-enabled and multi-agent systems, using practical SOC and telecom-security scenarios.
Status: Educational / workshop repository.
The examples use simulated data and simplified security workflows. They are not production security controls and should not be used to make autonomous security decisions without appropriate validation and human oversight.
The workshop is organized into two stages:
Start with focused LLM applications and structured prompt engineering.
Topics include:
- Prompt engineering for security operations
- Email threat detection
- Security incident report generation
- Network anomaly explanation
- CDR fraud pattern analysis
- Log event contextualization
- SIM swap investigation
- Basic ROI modeling for AI-assisted workflows
Notebook:
day1_single_llm_use_cases.ipynb
A Python export of the notebook is also available:
Build on the first day by introducing tool calling, specialized agents and coordinated security workflows.
Topics include:
- Tool calling and external system access
- Security investigation agents
- Autonomous threat-hunting workflows
- Threat-hunting hypothesis generation
- Multi-agent orchestration
- Response decision frameworks
- Human-in-the-loop decision making
- Incident triage and documentation
- End-to-end incident-response workflows
Notebook:
day2_advanced_multi_agent_systems.ipynb
The examples gradually evolve from a simple LLM interaction:
Security Event
│
▼
Prompt + Context
│
▼
LLM
│
▼
Structured Analysis
into tool-enabled agents:
Security Alert
│
▼
Investigation Agent
│
├── Firewall Logs
├── Threat Intelligence
└── Security Data
│
▼
Correlated Assessment
and finally into multi-agent workflows:
Incoming Alert
│
▼
Triage Agent
│
▼
Investigation Agent
│
▼
Response Decision Agent
│
▼
Documentation Agent
│
▼
Incident Report
The goal is to demonstrate the architectural progression from LLM-assisted tasks to agentic workflows, rather than treating every problem as a chatbot use case.
Analyzes suspicious emails and produces structured information such as:
- threat verdict
- confidence level
- threat indicators
- attack type
- risk score
- potential impact
- recommended action
Uses callable tools to correlate information from multiple simulated security systems, including firewall logs and threat-intelligence data.
Generates structured threat-hunting hypotheses based on available threat intelligence and organizational context.
Investigates a hypothesis using available security data and produces a threat-hunting assessment.
Demonstrates a decision framework for separating:
- low-risk automated actions
- recommended actions requiring approval
- high-impact decisions requiring human escalation
Demonstrate how specialized agents can participate in a broader incident-response pipeline.
The workshop examples use:
- Python
- Jupyter / Google Colab
- Arshai
- OpenRouter
- LLM-based agents
- asynchronous Python workflows
- function / tool calling
- structured prompting
The examples currently configure:
model="openai/gpt-4o-mini"
temperature=0.0The model configuration can be changed depending on the provider and use case.
git clone https://github.com/Mahdi-Ba/test-llm.git
cd test-llmpip install arshaiexport OPENROUTER_API_KEY="your-api-key"For Google Colab, the notebooks also support loading the key from Colab Secrets.
Open:
day1_single_llm_use_cases.ipynb
Then continue with:
day2_advanced_multi_agent_systems.ipynb
Using the notebooks directly is recommended because some cells are designed for an interactive notebook environment.
Prompt Engineering
↓
Single LLM Calls
↓
Reusable AI Agents
↓
Tool Calling
↓
Security Investigation
↓
Specialized Agents
↓
Multi-Agent Workflows
↓
Human-in-the-Loop Decisions
This progression highlights an important engineering principle:
Use the simplest AI architecture that can reliably solve the problem.
Not every security task requires an autonomous agent or a multi-agent system.
These examples intentionally simplify real security infrastructure so that the architectural concepts are easier to understand.
Before adapting similar patterns for production systems, areas such as the following require additional engineering:
- authentication and authorization
- secrets management
- audit logging
- prompt-injection defenses
- structured and validated model outputs
- model evaluation
- false-positive / false-negative analysis
- observability and tracing
- retry and failure handling
- data privacy and retention
- human approval boundaries
- least-privilege access to external tools
- deterministic controls around high-impact actions
LLM output should not be treated as authoritative security evidence by itself.
The email samples, firewall logs, threat-intelligence records, alerts and user-activity examples in this repository are workshop/demo data.
They are intended to demonstrate AI-system behavior and architecture rather than represent a validated security dataset.
Similarly, ROI calculations included in the notebooks are educational examples and should not be interpreted as measured production results.
This repository may be useful for:
- security engineers exploring LLM applications
- SOC teams evaluating AI-assisted workflows
- AI engineers learning tool calling and agent architecture
- telecom engineers exploring security automation
- instructors teaching applied AI and agentic systems
- technical leaders evaluating where LLMs can — and cannot — add value to security operations
The main objective of this workshop is not simply to call an LLM.
It is to explore how AI capabilities can be introduced incrementally into an existing software and security architecture:
single task → structured workflow → tools → specialized agents → coordinated system
while keeping reliability, security boundaries and human oversight in mind.
test-llm/
│
├── day1_single_llm_use_cases.ipynb
│ └── Single-LLM applications for telecom security
│
├── day1_single_llm_use_cases.py
│ └── Python export of the Day 1 notebook
│
└── day2_advanced_multi_agent_systems.ipynb
└── Tool-enabled and multi-agent security workflows
Mahdi Bahari
AI & Technology Leader · Agentic AI · Software & Solution Architecture · Educator