AI-Assisted SOC Alert-Triage Assistant · Hacking Project

Reduce alert fatigue and mean-time-to-triage by automatically enriching, correlating, and prioritizing SOC alerts with explainable AI recommendations.

**The problem**
SOC analysts face crippling alert volume and fatigue, with a high ratio of false positives and low-context alerts that consume tier-1 time and delay response to real threats. Manual triage is slow, inconsistent, and does not scale with telemetry growth, causing mean-time-to-triage to balloon and genuine incidents to be missed. Enterprises need automated enrichment, correlation, and prioritization that preserves analyst judgment rather than replacing it.

**What you'll build**
Build an AI-assisted triage assistant that ingests SIEM/EDR alerts, auto-enriches them with threat intelligence, asset context, and user/entity risk, then uses an LLM plus ML classifiers to summarize, deduplicate, correlate related alerts into incidents, and recommend a priority and next action. Ground the LLM with a RAG layer over playbooks and prior investigations to produce explainable, citation-backed triage narratives, and map each alert to MITRE ATT&CK. Expose it as a copilot inside the analyst workflow with feedback capture for continuous improvement.

**Objective** — Reduce alert fatigue and mean-time-to-triage by automatically enriching, correlating, and prioritizing SOC alerts with explainable AI recommendations.

**Expected outcome** — A working triage copilot that ingests sample SIEM alerts and outputs enriched, ATT&CK-mapped incident summaries with priority scores and recommended actions, plus a measured reduction in triage time on a test dataset.

**Difficulty** — Advanced — integrates SIEM data engineering, ML classification, RAG/LLM grounding, and SOC domain modeling into a reliable, low-hallucination workflow.

**Primary category** — SOC / Detection & Response; Secondary = AI/ML Security, Threat Intelligence, Security Automation (SOAR)

**Security domains** — Primary = Blue Team; Secondary = AI Security, Incident Response, Threat Intelligence, SOC Automation

**Technical focus** — alert triage, SIEM/EDR integration, alert enrichment, incident correlation, RAG grounding, LLM summarization, UEBA context, threat-intel enrichment, SOAR automation, MITRE ATT&CK mapping

**Core technologies** — Languages: Python, SQL; Frameworks/Libraries: LangChain/LlamaIndex, scikit-learn, FastAPI, pandas; Security Tools: Splunk/Elastic SIEM, Wazuh, TheHive, MISP, OpenCTI, Sigma; Cloud/Infra: Docker, Kubernetes, message queue (Kafka), Elastic stack; AI/Data: LLM API, sentence-transformers, vector DB, ATT&CK STIX data; Databases: Elasticsearch, PostgreSQL, vector store (FAISS/Weaviate)

**Where it's valued** — MSSPs/MDR providers, enterprise SOCs across finance, healthcare, retail, critical infrastructure; SIEM/XDR vendors

**Careers it builds toward** — SOC Analyst (Tier 2/3), Detection Engineer, Security Automation Engineer, AI Security Engineer, Threat Intelligence Analyst

**Framework alignment**
• MITRE ATT&CK: used defensively for alert-to-technique mapping across Execution, Persistence, Privilege Escalation, Command and Control, Exfiltration; enables coverage analysis (note: ATLAS applies if triaging AI-system attacks)
• NIST CSF 2.0: Detect (continuous monitoring, event analysis), Respond (analysis, mitigation, triage), Identify (asset/risk context)
• OWASP: LLM Top 10 — LLM06 Sensitive Information Disclosure, LLM08 Excessive Agency, LLM09 Overreliance (guarding the copilot itself); otherwise N/A to web
• CIS Controls v8: Control 8 Audit Log Management, Control 13 Network Monitoring and Defense, Control 17 Incident Response Management

**Innovation** — Improved Existing Solution / Enterprise Product — SOC copilots are emerging commercially (Microsoft Security Copilot, etc.), but an explainable, ATT&CK-mapped, RAG-grounded triage assistant is a strong portfolio and enterprise play. Scores: Innovation 7/10, Startup 7/10, Enterprise-Readiness 8/10, Patent = No.