AI Agent for Security Alert Triage
Tier-one triage is mostly lookups: whose machine is this, what does this account normally do, has this fired before, what does the rule actually detect. This agent does those lookups on every alert and presents a proposed disposition with the artefacts attached, so an analyst decides instead of gathering.
What is an AI SOC analyst?
An AI SOC analyst is a governed software worker that performs first-line security alert triage. It enriches each alert with asset, identity, behavioural and detection context, groups related signals from separate tools into candidate sequences, and proposes dismissal or escalation with the supporting and contradicting evidence recorded for a human analyst.
What it does
What it is not
The alert that mattered was closed in eleven seconds
Alert volume forces a triage speed at which proper enrichment is impossible, so analysts learn to recognise shapes rather than investigate them. That works until the day a genuine intrusion produces an alert that looks like the four hundred benign ones before it, and the queue depth is the reason nobody looked.
Enrichment costs more than triage
Establishing who owns a host and what the account normally does takes longer than the decision it informs.
Volume trains pattern-matching
After enough false positives on one rule, the next alert from it is dismissed on sight rather than assessed.
Dispositions are not explained
An alert is closed as benign with no record of why, so the same judgement is made again from scratch next week.
Related signals stay separate
Three low-severity alerts across endpoint, identity and network describe one sequence and are each closed alone.
The lookups done before the analyst arrives
Enrichment
Everything A Tier One Would Look Up
Gathered before the alert is opened.
Asset ownership and criticality, the account’s normal behaviour, recent related signals across other tools, the detection logic that fired and how similar alerts were previously dispositioned are all assembled and attached to the alert.
- Asset owner and business criticality
- Baseline behaviour for the account
- Related signals from other tools
- The detection logic that actually fired
Before triage starts
Correlation
Three Alerts, One Sequence
Grouped before they are judged.
Alerts sharing an account, host or time window are grouped into a single candidate sequence, so a pattern that is unremarkable in any one tool but coherent across three is visible at the point of triage rather than in hindsight.
One sequence
Disposition
A Recommendation With Its Reasoning
And the analyst still decides.
The agent proposes dismissal or escalation and states why, naming the evidence that supports the view and the evidence that argues against it, so an analyst can disagree with the reasoning rather than only with the conclusion.
For and against
How the AI SOC Analyst runs a task
- STEP 01
Read the alert and the rule
The alert is parsed together with the detection logic that produced it, because what a rule actually matches is frequently narrower or broader than its name suggests, and triage that skips this step assesses the wrong thing.
Alert parsingDetection logic read - STEP 02
Gather the context
Asset ownership and criticality, the account’s usual access pattern, the host’s recent activity and any change or maintenance window covering the period are retrieved, which is the bulk of what manual triage spends its time on.
Asset lookupIdentity baselineChange window - STEP 03
Look for the sequence
Other signals sharing the same account, host or short time window are pulled in, since an intrusion usually produces several individually unremarkable alerts across tools that are coherent only when read together.
Signal correlationTime window grouping - STEP 04
Compare with what came before
Previous alerts of the same shape and their recorded dispositions are surfaced, so a documented benign pattern is recognised as one and a previously escalated pattern is not quietly dismissed by a different analyst.
Prior disposition lookupPattern matching - STEP 05
Propose and hand over
A disposition is proposed with the evidence for and against it and a confidence statement, and the analyst accepts, rejects or escalates — with the artefacts already packaged if it moves to investigation.
Disposition proposalArtefact packaging
Systems the AI SOC Analyst connects to
Telemetry
Analysis
Inputs, outputs and runtime
- Ingests
- SIEM alertDetection rule logicAsset inventoryIdentity and access logsPrior disposition history
- Produces
- Enriched alert packetCorrelated signal groupProposed disposition with reasonsConfidence statementEscalation artefacts
- Triggered by
- New alert in the queueAlert severity changeShift handover review
- Human oversight
- An analyst accepts or rejects every disposition
- Models
- Open-weight LLMs you host — Llama, Qwen or Mistral class
- Typical latency
- Under a minute per alert
- Deployment
- On-premise or sovereign cloud with egress control
- Data residency
- Telemetry is read inside your own network
Where the SOC Analyst pays back
Queue Enrichment
Attach asset, identity and behavioural context to every alert before an analyst reaches it.
Repeat False Positive Handling
Recognise alerts matching a previously documented benign pattern and present the prior disposition with them.
Cross-Tool Correlation
Group signals from endpoint, identity and network that share an actor or host into one candidate sequence.
Shift Handover
Pass the open queue with each alert’s current state, gathered evidence and proposed disposition intact.
Escalation Packaging
Hand an investigation the artefacts, timeline fragment and reasoning rather than an alert identifier.
Detection Tuning Evidence
Report which rules generate dismissals at a rate that makes them worth retuning rather than working.
AI SOC Analyst vs chatbots and SaaS copilots
The bottleneck in a security operations centre has never been analytical skill; it is that each alert requires five lookups across four consoles before anyone can say anything useful about it.
| Generic chatbot | SaaS copilot | VDF AI | |
|---|---|---|---|
| Enrichment | None | Single tool | Asset, identity and history |
| Correlation | Not possible | Within one product | Across separate tools |
| Prior dispositions | Unavailable | Sometimes | Surfaced with the alert |
| Reasoning | Generic explanation | Score only | Evidence for and against |
| Closing alerts | Not applicable | Auto-close rules | Never — analysts close |
| Containment | Suggests freely | May execute | Never — analyst executes |
| Telemetry exposure | Pasted to vendor | Vendor cloud | Stays in your environment |
Governance and controls
Security telemetry is a map of the estate and its gaps, so the two properties that make an agent acceptable here are that it cannot act and that the data it reads never leaves the network it describes.
Read-only tool access
No write to SIEM, EDR or identity
No containment capability
Isolation and blocking are human acts
No alert closure
Dispositions are proposals only
Reasoning recorded
Each proposal states its evidence
Artefacts preserved
Evidence retained for investigation
Analyst attribution
The deciding analyst is recorded
Evidence it leaves behind
What changes after rollout
Who runs the AI SOC Analyst
Tier-one SOC analyst
Opens alerts where the five console lookups have already happened, and spends the shift on judgement calls rather than on establishing whose laptop generated the event and whether that is normal for them.
SOC manager
Gets dispositions with written reasoning rather than closure codes, which makes it possible to review triage quality and to identify the rules whose dismissal rate makes them a tuning problem.
Detection engineer
Receives evidence about how each rule actually behaves in production — what it matches, how often it is dismissed, and on which assets — instead of hearing anecdotally that one of them is noisy.
Questions about the AI SOC Analyst
What is an AI SOC analyst?
It is an agent that performs first-line security alert triage: gathering the asset, identity, behavioural and detection context an analyst would look up, grouping related signals into sequences, and proposing a disposition with the reasoning and artefacts recorded.
How is an AI SOC analyst different from a generic chatbot?
A chatbot can explain what an alert type generally means. This agent reads your own SIEM, endpoint and identity telemetry, and its proposal cites the specific evidence from your environment.
Can an AI SOC analyst run on-premise on security alert telemetry data?
Yes. Security telemetry names your hosts, accounts, internal addresses and detection coverage, which makes it among the worst material to send outside the network it describes.
What does an AI SOC analyst produce, and in what format?
An enriched alert with asset and identity context, related signals grouped into a sequence, a proposed disposition with supporting and contradicting evidence, and the artefacts for escalation.
Where does an AI SOC analyst fit in a governed AI programme?
It triages and recommends only. Closing an alert, containing a host and blocking an address are analyst decisions, and deeper evidence work belongs to the security investigation agent.
Can it close alerts automatically to reduce the queue?
No, and that restriction is the point rather than a limitation. Automatic closure means the queue shrinks whether or not the reasoning was sound, and the failure is silent by construction because a closed alert generates no further signal. The agent reduces the time each decision takes, which addresses the same volume problem without removing the accountability.
How is this different from the AI Security Investigation Agent?
Depth and trigger. This agent works the whole queue, spending a bounded amount of effort on each alert to reach a disposition. The investigation agent takes something already escalated and goes deep: correlating evidence across sources into a defensible timeline, establishing scope and impact, and producing findings that may be read by a regulator. Triage decides what is worth investigating; investigation establishes what happened.
Will it miss a novel attack because it compares against prior dispositions?
Prior dispositions are one input, not the decision. Behavioural deviation, correlation across tools and the detection logic itself are weighted independently, and an alert matching a benign pattern but showing unusual sequence or access is escalated regardless of history. The agent also reports when its confidence is low rather than defaulting to dismissal, which is the failure mode that matters here.
Does it need our data to train a model?
No. It runs open-weight models you host, reading your telemetry at inference time through read-only connections. Nothing is used for training, and no telemetry is transmitted outside your environment. Where you want behavioural baselines, those are computed from your own data and stored inside your perimeter like any other operational state.
What happens when an alert turns out to be an IT fault rather than an attack?
It says so and routes it. A substantial share of security alerts are misconfigurations, failed jobs or maintenance activity nobody recorded, and the useful output is identifying them as operational rather than closing them as false positives. Those cases are handed to the IT side with the evidence attached, which also stops the same misconfiguration generating alerts for another six weeks.
Give every alert its context before triage
See the AI SOC Analyst enrich and triage a live alert queue.