Ranking SOC Incidents by Risk, Not Severity: Microsoft's AIP at Scale
Any analyst who has drained a Defender queue on a Tuesday morning knows the shape of the problem: two dozen "High" incidents, one that actually matters, and no signal separating them.
Ranking SOC Incidents by Risk, Not Severity: Microsoft’s AIP at Scale
Any analyst who has drained a Defender queue on a Tuesday morning knows the shape of the problem: two dozen “High” incidents, one that actually matters, and no signal separating them. Microsoft’s Adaptive Incident Prioritization (AIP), now shipping inside Defender Queue Assistant, replaces the severity-sort default with a BM25-style ranker that continuously scores incidents against normalized security components, global rarity, and domain-prior multipliers. The published result: 92.8% Precision@10 and a 5.8–17.5% lift in analyst engagement versus severity ordering, deployed across tens of thousands of tenants with a ~5s median refresh latency.
Those numbers reframe a debate that NIST SP 800-61r2 has been quietly losing for a decade: static severity is a coordination artifact, not a triage function. Rarity and context are.
What the ranker actually optimizes
AIP treats an incident as a document and the analyst’s attention as the query. BM25’s saturation curve is the right shape here — one extra malicious file above five stops adding signal, while a globally rare command-line pattern deserves a rarity multiplier that outweighs three commodity alerts. Domain priors then encode tenant-specific realities: a healthcare tenant weighting Kerberoasting differently than a fintech tenant weighting OAuth token abuse.
aip_scoring:
components:
- name: normalized_security_score
source: defender.incident.severity_normalized
- name: global_rarity
source: mde.telemetry.rarity_index
idf: true
- name: domain_prior
lookup: tenant_profile.industry_multiplier
refresh_latency_p50_seconds: 5
precision_at_10_target: 0.90The engineering choice that carries the paper is continuous re-ranking. Static queues degrade the moment a new indicator lands; AIP recomputes on each ingestion cycle, which is why the reported Precision@10 stays stable across shift boundaries rather than drifting downward through the afternoon.
Why this matters beyond Defender
The extended Microsoft GUIDE dataset now carries expert priority labels for 9,980 incidents — a public benchmark for anyone building triage rankers instead of just detectors. Detection research has crowded ACM and IEEE proceedings for years while triage was left to product severity fields. AIP reopens triage as a first-class ranking problem, and the labeled dataset lets outside teams reproduce the evaluation rather than trust a vendor benchmark.
For EU operators, this lands on the NIS2 Directive (EU) 2022/2555 operational-measure obligations and the ENISA Threat Landscape 2024 observation that SOCs regularly miss real incidents buried inside inflated High queues. Ranking-based triage is now the compliant default, not an optimization.
At CAI Technology we treat prioritization as a control plane, not a UI sort. Our AEGIS SOC engineering practice plugs adaptive rankers into tenant-specific domain priors, and our agent-safety topology work applies the same rarity-weighting logic to autonomous-agent action queues where severity fields do not exist at all. If your queue depth grew faster than your headcount this quarter, the fix is a ranker — start a two-week discovery on your existing Defender telemetry.