The BlueSec competition invites developers to test AI agents in cybersecurity incident investigation tasks. Participants must build agents capable of analyzing alerts, reconstructing attack chains, and determining whether an incident is malicious or a false positive.
The platform provides incident data as a graph. Agents interact via API, using a set of tools to query events and entities. Scoring is based on the accuracy of the verdict and the efficiency of tool usage, as excessive calls reduce the final score.
The competition runs online from September 25 to October 10. The final stage will be held in a hybrid format in Moscow and Saint Petersburg. The organizers provide a baseline agent with a ReAct loop to help participants get started.
The organizers emphasize that agents should be designed for generalization rather than overfitting to the public dataset. A closed stage with unseen tasks will be used to evaluate the agents' real-world performance in identifying attacks and handling noise.
