How a 1st Year Student Built an Autonomous Incident Response Agent Using FalkorDB Graph Theory and AI Agents

By a 1st-Year Computer Science Student | Built for Graph Hacks: Context for AI Agents (WeMakeDevs & FalkorDB)

At 3:14 AM on a Saturday, an automated alert fires in a bank’s Security Operations Center (SOC): 🚨 Trojan.Generic reverse-shell detected on Web-Server-Public.

In 99% of enterprise environments today, two bad things happen:

When I read the challenge prompt for Track 01 ("Agents That Act on Connected Data") in the WeMakeDevs & FalkorDB Graph Hacks, I asked myself:

Can we build an autonomous AI agent that traces multi-hop lateral movement in real time and surgically neutralizes the attack with **zero collateral business downtime?

The answer is BreachGraph, and here is how I built it using FalkorDB and Google Gemini.

Before writing a single line of Cypher, I realized that conventional database paradigms fundamentally break down when solving this problem:

FalkorDB is an in-memory graph database built in C and Redis. Graph traversals execute in microseconds, allowing an AI agent loop to query, simulate, and mutate network state on every single turn of its reasoning loop.

We modeled our enterprise infrastructure using a heterogeneous directed property graph:

graph LR A["Server: Web-Server-Public<br/>(Infected)"] -->|CAN_NETWORK_ACCESS| B["Server: Internal-API-Gateway"] B -->|STORES_CREDENTIAL| K["UserKey: DB-Admin-Key"] K -->|AUTHENTICATES_TO| DB[("Database: Customer-CreditCard-DB<br/>(PCI-DSS Vault)")] SVC["Service: Checkout-Billing-Service<br/>($500k/hr Revenue)"] -->|DEPENDS_ON| B Nodes: (:Server {name, ip, tier, status}) (:Database {name, classification, records, status}) — Tagged with PCI-DSS. (:UserKey {name, role, permissions, status}) — IAM credentials and API keys. (:Service {name, revenue_impact_per_hr, status}) — Operational business services. (:Vulnerability {cve, severity, cvss}) — CVE security metadata. Relationships: (:Server)-[:CAN_NETWORK_ACCESS]->(:Server) (:Server)-[:STORES_CREDENTIAL]->(:UserKey) (:UserKey)-[:AUTHENTICATES_TO]->(:Database) (:Service)-[:DEPENDS_ON {revenue_impact_per_hr}]->(:Server) Notice the key architectural innovation: We unified the Threat Graph with the Business Dependency Graph in the same database.

In classical computer science, separating two nodes (an infected origin s and a sensitive target t) while minimizing the cost of severed edges is known as the Minimum-Weight Cut (Min-Cut) Problem.

Instead of guessing, our agent lets FalkorDB calculate the optimal cut dynamically:

MATCH path = shortestPath (( origin: Server { name: $comp }) - [ * 1.. 5 ] -> ( vault: Database { name: $db })) UNWIND nodes ( path ) AS candidate WHERE labels ( candidate )[ 0 ] <> 'Database' AND candidate.name <> $comp OPTIONAL MATCH ( dependent ) - [:DEPENDS_ON ] -> ( candidate ) RETURN candidate.name AS cut_target, labels ( candidate )[ 0 ] AS target_type, sum ( coalesce ( dependent.revenue_impact_per_hr, 0 )) AS collateral_damage_per_hr, collect ( coalesce ( dependent.name, 'None' )) AS disrupted_services ORDER BY collateral_damage_per_hr ASC LIMIT 1 Enter fullscreen mode Exit fullscreen mode What FalkorDB Evaluates in Real Time: Option A (Blunt Force): Cut Internal-API-Gateway. Incoming operational dependencies: Checkout-Billing-Service ($500,000/hr).

Collateral Damage: $500,000.00/hr. Option B (Surgical Cut): Revoke DB-Admin-Key. Incoming operational dependencies: None ($0/hr).

Collateral Damage: $0.00/hr. FalkorDB’s query engine returns Candidate B as the mathematically minimal cut. The agent autonomously selects Candidate B, revoking the credential key in FalkorDB:

MATCH ( k: UserKey { name: $name }) SET k.status = 'REVOKED' WITH k MATCH ( k ) - [ r: AUTHENTICATES_TO ] -> ( d: Database ) DELETE r RETURN k.name, k.status Enter fullscreen mode Exit fullscreen mode Result: The attack vector is completely severed in 0.4 seconds, while checkout operations experience zero seconds of downtime.

Building this project taught me several invaluable software engineering lessons recommended directly in WeMakeDevs & FalkorDB's technical resources:

When running BreachGraph, you see the system working in real time across two interfaces:

Finally, the agent automatically exports a compliant digital forensic artifact ( forensic_incident_report.json ) documenting the breached path, the nanosecond timestamp of the graph cut, and the calculation of $500,000/hr in preserved revenue.

As a first-year CS student, building BreachGraph showed me that the hardest questions in AI agents aren't about single records—they are about connections.

By placing FalkorDB at the heart of our agent's decision loop, we turned what used to be a 4-hour human scramble into a 3-second autonomous response.