Incident response (IR) is a critical aspect of cybersecurity, requiring rapid decision-making and coordinated efforts to address cyberattacks effectively. Leveraging large language models (LLMs) as intelligent agents offers a novel approach to enhancing collaboration and efficiency in IR scenarios. This paper explores the application of LLM-based multi-agent collaboration using the Backdoors & Breaches framework, a tabletop game designed for cybersecurity training. We simulate real-world IR dynamics through various team structures, including centralized, decentralized, and hybrid configurations. By analyzing agent interactions and performance across these setups, we provide insights into optimizing multi-agent collaboration for incident response. Our findings highlight the potential of LLMs to enhance decision-making, improve adaptability, and streamline IR processes, paving the way for more effective and coordinated responses to cyber threats.

翻译：事件响应（IR）是网络安全的关键环节，要求快速决策与协调行动以有效应对网络攻击。利用大型语言模型（LLM）作为智能代理，为提升IR场景中的协作效率提供了一种创新方法。本文基于专为网络安全训练设计的桌面推演框架Backdoors & Breaches，探讨了LLM驱动的多智能体协作应用。我们通过集中式、分布式及混合式等多种团队结构模拟真实IR动态，并通过分析不同配置下智能体的交互与表现，为优化事件响应中的多智能体协作提供见解。研究结果凸显了LLM在增强决策能力、提升适应性及优化IR流程方面的潜力，为构建更高效协同的网络威胁响应机制奠定了基础。