Soc Response Planner

Purpose

Select the best response action via multi-candidate simulation, rollout-based estimation, and explicit scoring.

Invoke When

• You already have incident + state + RAG output.
• Multiple valid response actions exist and one must be prioritized.
• You need reduced hallucination by rejecting non-improving actions.

Inputs

• Current 6D state
• Candidate actions (3~5 preferred)
• History actions
• Planner config (rollout_count, depth, penalty weights)

Output Contract

Return JSON only:

{
  "recommended_action": {},
  "ranked_actions": [],
  "reasons": {},
  "expected_recovery_effect": {},
  "risk_alerts": [],
  "executable": {
    "shell": "",
    "api": ""
  },
  "explainability": {}
}