Autonomous SOC Alert-Triage Agent · Hacking Project

Automatically enrich, correlate, and triage SOC alerts with an explainable AI agent that escalates true positives and suppresses noise.

**The problem**
SOC analysts drown in thousands of daily alerts, most of them false positives, causing alert fatigue, slow response, and missed true positives. Manual triage — gathering context, enriching indicators, and deciding severity — is repetitive and inconsistent across analysts. The industry faces a persistent talent shortage that manual, tier-1 triage only worsens.

**What you'll build**
Build an autonomous SOC triage agent that ingests SIEM/EDR alerts, automatically enriches them (threat intel, asset context, user risk, historical similarity), and reasons over the evidence with an LLM to produce a triage verdict, severity, ATT&CK mapping, and recommended next actions. The agent clusters related alerts into incidents, suppresses known benign patterns, and escalates high-confidence true positives with a full evidence narrative for the analyst. Human-in-the-loop review and explainability keep analysts in control while dramatically cutting time-to-triage.

**Objective** — Automatically enrich, correlate, and triage SOC alerts with an explainable AI agent that escalates true positives and suppresses noise.

**Expected outcome** — A working triage agent that ingests sample alerts and outputs enriched, ATT&CK-mapped triage verdicts with severity and recommended actions, plus a measured false-positive reduction.

**Difficulty** — Advanced — requires SIEM/EDR integration, enrichment pipelines, LLM reasoning with grounding, and careful evaluation to avoid missing true positives.

**Primary category** — SOC; Secondary = Detection Engineering, AI/ML Security, Threat Intelligence

**Security domains** — Primary = Blue Team; Secondary = AI Security, Incident Response, Threat Intelligence

**Technical focus** — Alert triage, alert enrichment, alert correlation/clustering, threat-intel integration, LLM reasoning/tool-use, ATT&CK mapping, false-positive reduction, incident narrative generation, human-in-the-loop workflow, explainability

**Core technologies** — Languages: Python, SQL; Frameworks/Libraries: LLM agent framework (LangGraph), FastAPI, STIX/TAXII clients; Security Tools: SIEM (Elastic/Splunk/Wazuh), EDR APIs, MISP/threat-intel feeds, Sigma; Cloud/Infra: Docker/K8s, message queue, vector store; AI/Data: LLM with tool-use, embeddings for alert similarity, classifier for triage; Databases: PostgreSQL, OpenSearch/Elasticsearch, vector database

**Where it's valued** — Enterprises with SOCs, MSSPs/MDR providers, financial services, technology, government

**Careers it builds toward** — SOC Analyst (Tier 1-3), Detection Engineer, SOC Automation Engineer, AI Security Engineer, Threat Intelligence Analyst

**Framework alignment**
• MITRE ATT&CK: used as the classification and mapping backbone — the agent tags each alert to tactics/techniques (e.g., T1059 Execution, T1071 C2, T1078 Valid Accounts) across the matrix. MITRE ATLAS applies to hardening the agent itself against prompt injection via alert content
• NIST CSF 2.0: Detect (primary), Respond, Identify
• OWASP: LLM Top 10 (LLM01 Prompt Injection — since alert data is untrusted input, LLM06 Excessive Agency) for securing the agent
• CIS Controls v8: 8 (Audit Log Management), 13 (Network Monitoring & Defense), 17 (Incident Response Management)

**Innovation** — Startup Potential — autonomous AI SOC triage is one of the most active security-AI markets; an explainable, ATT&CK-mapped agent with measured FP reduction has strong commercial and enterprise pull. Scores: Innovation 8/10, Startup 8/10, Enterprise-Readiness 7/10, Patent = Possible.