SecLLM-Intent-Driven Orchestration of Heterogeneous Security Devices via MCP Function Calling and Retrieval-Augmented Generation

Heterogeneous security infrastructures-network-detection, endpoint-detection, threat-intelligence and ticketing systems-remain siloed, impeding real-time collaboration and prolonging incident response. We introduce SecLLM, an intent-driven orchestration framework that couples a 32-billionparameter large-language model with (i) Model-Context-Protocol (MCP) function calling for deterministic, auditable control-plane actions and (ii) retrieval-augmented generation (RAG) for dynamic knowledge grounding. Given a natural-language goal such as "quarantine lateral-movement hosts and patch vulnerable SMB services", SecLLM parses the intent into a typed task-graph, enriches each node with live device capabilities drawn from a 50 M-artifact vector store, then safely executes the plan across NDR, EDR and SOAR devices while reflecting on intermediate results. In a 72-hour replay of the publicly available CIC-IDS2018 network trace plus host logs, SecLLM cuts mean time-to-containment by 80% (38 → 7.4 min) and reduces false-positive escalations by 42% relative to a production SOAR baseline. Ablations show that removing RAG slows containment by 19%, while disabling MCP yields unsafe, non-deterministic actions. These results demonstrate that intent-aligned LLMs, when grounded via RAG and constrained by strongly typed schemas, can safely automate cross-device security operations at scale.