When the Sensor Starts Thinking: SnortML, Agentic AI, and the Evolving Architecture of Intrusion Detection

SnortML is a machine learning detection engine embedded natively in Snort 3, using an LSTM model to classify HTTP parameters for SQL injection, XSS, and command injection with sub-millisecond inference on-device. Unlike signature-based rules, it generalizes across syntactic variants of known attack classes, addressing the exposure window between novel exploits and rule availability. The post examines SnortML's architecture in detail — adaptive model selection by input length, parallel execution alongside classical signatures, and probabilistic output — then explores its limitations: HTTP-only coverage, no cross-request temporal context, and no published adversarial robustness data. The second half covers agentic AI in SOC operations, contrasting it with SOAR playbooks and conventional ML models, and proposes a layered integration architecture where Snort feeds specialized investigation agents. Key gaps identified include missing feedback loops from confirmed incidents back to model retraining, underdeveloped explainability for ML alerts, and immature interoperability standards for multi-agent platforms. Practical deployment guidance recommends starting SnortML in passive monitoring mode, treating ML scores as one factor in composite confidence, and keeping humans in the loop for containment decisions.