Building an AI triage layer for a small SOC

AI in security tooling is mostly hype until it removes work a human was actually doing. For a two-person team fielding a few hundred alerts a day, the work worth removing was obvious: first-pass triage.

The problem

Every alert looked urgent until you read it. Analysts spent their mornings closing false positives instead of investigating the handful of things that mattered. Alert fatigue is a security risk in itself — the real incident hides in the noise.

The approach

I built a triage layer that sits between the SIEM and the humans:

1. Enrichment — each alert is auto-augmented with asset context, recent sign-in history, and threat-intel reputation before anyone sees it.
2. LLM summarisation — a model condenses the enriched alert into a two-line "what happened / why it might matter" summary and proposes a severity.
3. Human-in-the-loop — the model never closes anything. It ranks and drafts; an analyst confirms with one click.

The guardrails

This is where most "AI SOC" projects go wrong. The rules I held to:

• The model's severity is advisory — it reorders the queue, it doesn't auto-resolve.
• Every model decision is logged with its inputs, so a wrong call is auditable, not mysterious.
• Prompts are treated as untrusted-input-adjacent — alert content is clearly delimited so a crafted log line can't hijack the summary.

The result

Time-to-triage dropped by roughly 60%, and — more importantly — the two real incidents that quarter surfaced to the top of the queue within minutes instead of hours.

AI didn't replace the analysts. It gave them their mornings back so they could do the part of the job only a human can.