SOC Triage in Minutes: LLMs Over SIEM Alerts for Mid-Market
A mid-market SOC in Bucharest gets 14,000 SIEM alerts on a quiet Wednesday. Two analysts. Do the math — nobody reads them.
SOC Triage in Minutes: LLMs Over SIEM Alerts for Mid-Market
A mid-market SOC in Bucharest gets 14,000 SIEM alerts on a quiet Wednesday. Two analysts. Do the math — nobody reads them. The queue silently drops everything below “critical”, and the attacker who chained three “medium” events walks in through the gap.
That gap is what a language model, wired correctly, actually closes. Not by replacing the analyst. By reading every alert the analyst never will.
Why the mid-market SOC breaks first
The ENISA Threat Landscape 2024 records ransomware and data-related threats as the dominant vectors across EU organisations, with detection-to-containment times measured in days for smaller teams (ENISA Threat Landscape 2024). NIST SP 800-61r2 codifies the four-phase incident lifecycle, but assumes a rota big enough to run it (NIST SP 800-61r2). Mid-market SOCs — usually 2 to 6 analysts covering 50–250-employee shops — have neither the rota nor the tooling budget of a bank.
Directive (EU) 2022/2555 (NIS2) does not care. Essential and important entities must report significant incidents within 24 hours (Directive (EU) 2022/2555). A 200-person managed-service provider is on the same clock as Deutsche Telekom.
The LLM layer, in one diagram
The trick is not “ask GPT to triage”. It is a two-tier pipeline that turns SIEM noise into structured, MITRE-mapped verdicts before a human touches it.
The LLM does one job: read the raw event plus enrichment, emit a JSON verdict with an ATT&CK technique ID, a plain-language narrative, and a confidence score. MITRE ATT&CK v15 gives it the taxonomy (MITRE ATT&CK). The rule engine handles the boring 70%.
A real output row from a pilot we ran last month:
2026-07-14T02:41:09Z triage.llm alert_id=WZ-88214
rule=win_powershell_encoded technique=T1059.001
asset=fin-db-03 user=svc_backup confidence=0.92
verdict=likely_true_positive
narrative="Encoded PowerShell from service account outside
maintenance window (02:41 UTC, window 03:00-05:00 Sun).
No prior EncodedCommand from svc_backup in 90d."
action=escalate_tier2Where it breaks, and how we hold it
Prompt injection through log fields is the obvious risk — an attacker who controls a User-Agent string can try to steer the classifier. We treat every SIEM field as untrusted input and strip control tokens before the model sees them, aligning with the OWASP Top 10 for LLM Applications (OWASP LLM Top 10). The classifier never sees the response schema in the same context as user-controlled text.
The second failure mode is drift. A model that was 92% accurate in March is 78% in July because your estate changed. We run a weekly replay against the last 500 analyst decisions — see our note on alert-surface reduction without DPI and the broader agent failure taxonomy for the two disciplines this depends on.
CAI Technology’s position: the model is the cheapest part. The enrichment layer, the replay harness, and the analyst feedback loop are where 80% of the engineering lives — and where every vendor demo goes quiet. Talk to us about a two-week AEGIS SOC pilot on your existing SIEM before you buy anything.