Design a Security Monitoring Agent

Design an autonomous agent that monitors system logs, network traffic, and alerts, triages potential security incidents, investigates root causes by correlating events, and takes automated containment actions. Consider how the agent balances speed vs. false positives, handles permission scoping for destructive actions, and maintains audit trails.