AI Analyst: A New Level in the SOC

Security Operations Centers are under increasing pressure. While the complexity of IT environments continues to grow, SOC teams’ resources typically do not keep pace with this expansion. There is more technology to monitor, more data to process, and more alerts to evaluate in a short amount of time to determine whether they indicate a real threat or are merely noise.

In recent years, various responses have emerged to this situation. First came automation, then AI assistants, and now agentic AI-based approaches are increasingly coming to the fore. The question today is no longer whether artificial intelligence can be used in the SOC, but rather in what form it should be integrated to provide a real operational advantage.

Why isn't traditional SOC operation enough anymore?

The operation of SOCs is currently hampered by several interrelated problems:

• the volume of data and events is constantly growing,
• many organizations have more than 40 security and IT technologies running in parallel,
• there are too many alerts and a high false positive rate,
• there is intense pressure to migrate to the cloud and automate,
• it is difficult to find, train, and retain qualified professionals,
• analysts burn out quickly,
• critical roles are lacking in many places, such as threat hunting or CTI processing.

This situation is exacerbated by the fact that attackers are also making increasingly sophisticated use of AI. If security measures do not incorporate similarly advanced capabilities, this gap could quickly turn into a structural disadvantage.

The first step: automation and its limitations

One of the first major promises of SOC developments was automation linked to SOAR systems. The goal was to automate certain steps in incident management and, in some cases, even response actions.

In practice, however, limitations quickly became apparent. In many cases, automated intervention is not permissible for business, operational, or risk reasons. Additionally, a separate playbook had to be developed, maintained, and fine-tuned for every single incident or use case type. This requires significant expert capacity, while the operation is difficult to scale.

As a result, SOAR has in many cases ultimately become primarily an incident analysis and process support tool, rather than a fully autonomous incident management engine.

Step Two: AI Assistants

The next step was the emergence of assistant-style AI solutions. With these, the analyst can ask the system questions in natural language, request summaries, gather information, or ask for suggestions on how to interpret a given situation.

This is a significant step forward, but it has one major limitation: the human still initiates the process, formulates the question, interprets the answer, and, if necessary, drives the investigation forward with follow-up questions. A junior analyst may not necessarily know how to ask the right questions, and investigating a complex incident still requires deep professional context.

In other words, the AI assistant can be a great help, but humans remain the driving force behind the workflow.

The Next Level: Agentic AI in the SOC

The agentic AI-based approach goes a step further. Here, we are no longer talking about a simple question-and-answer-based assistant, but rather about software agents built on large language models (LLMs) that incorporate the necessary domain expertise, methodology, and operational logic.

Such a system is capable of handling a given problem from start to finish: it gathers information, builds context, identifies connections, constructs a narrative, and then makes recommendations for next steps. All of this while the human analyst remains in control throughout: they can pause the process, override the result, or add further context.

This human-in-the-loop model is one of the most important operating principles. The goal is not for AI to replace the analyst, but rather to take over repetitive, time-consuming tasks that require significant data processing, while humans retain control at decision-making and validation points.

A practical example: AI Analyst on the NetWitness platform

The practical implementation of the concept presented is an AI Analyst-type solution designed to review incidents generated in the SIEM and then recommend whether further action is necessary and, if so, what steps should be taken.

A key element of this approach is that it does not rely solely on the immediate context of the alert or incident. A SOC analyst does not merely look at which endpoint communicated with which IP address, but also at:

• what happened on the affected host before and after the event,
• which user the activity is associated with,
• how the process or service in question was launched,
• whether there were any downloads, privilege escalations, or lateral movement,
• whether the event is linked to activity observed on other systems.

AI Analyst follows the same logic: it uses the entire SIEM as a data source and is capable of gathering relevant information not only from logs, network data, and endpoint telemetry, but also from external and internal context sources. These may include, for example, asset and identity data, CTI information, or other third-party sources.

Why is the broader context important?

In a significant number of incidents, the basic information provided in the alert is not sufficient on its own to make the right decision. For example, if a server communicates with an IP address flagged as known to be malicious, that alone does not indicate whether a genuine compromise has occurred.

Making a decision may require understanding what process initiated the communication, under which user’s name it ran, what the triggering event was, whether there was a related download or lateral movement, and whether there are traces of the same activity in other data sources.

Agentic AI can take this to a new level because it not only collects data but is also naturally capable of connecting entities and activities that appear in different forms. It can also detect correlations that are harder to identify in traditional rule- or field-based correlation logic.

The output is not just a verdict, but a meaningful incident report

The true value of such systems lies not merely in their ability to determine whether an event is a true or false positive. The real benefit is that they also provide the complete analytical picture needed to make a decision.

A well-structured AI-based incident report may include:

• a narrative description of the potential attack chain,
• the relationships between the affected entities and systems,
• the relevant IOCs,
• the timeline,
• the scope, i.e., the extent of the incident,
• recommended next steps,
• as well as a final assessment of whether intervention is necessary.

This is important because a good report not only speeds up the analyst’s decision-making process, but also supports reporting, traceability, and auditability.

Not on a per-use-case basis, but universally

One of the key advantages of agentic AI is that it does not necessarily require the development of a separate process for every type of incident. If the system incorporates industry methodologies, analytical logic, and the organization’s own domain expertise, it may be able to provide useful analysis and recommendations even in new, previously unseen situations.

This is a fundamental difference compared to strictly playbook-based operations. It is not that structured processes lose their significance, but rather that the system is not limited to operating solely along predefined branches.

Data protection and European compliance: a key issue in the rollout of AI

The data processed in the SOC often contains personal or personally identifiable information. Therefore, one of the critical issues in AI implementation is how the solution handles data confidentiality and compliance requirements.

In the European context, this is a particularly sensitive area. A viable architecture must therefore be robust not only in terms of performance and accuracy, but also in terms of data management. Anonymization, on-premise logical controls, and GDPR-compliant operation are not optional features, but fundamental requirements.

What does this mean in practice?

The practical benefits manifest themselves on multiple levels simultaneously.

First, the time analysts spend mining raw data and compiling it into a preliminary format can be significantly reduced. Second, decision-making is accelerated because relevant information is presented in an interpretable format as structured reports. Third, the backlog can be reduced, and the team’s ability to truly focus on higher-risk cases can improve.

According to the presented findings, based on the analysis of thousands of incidents, the average traditional investigation time was 20–45 minutes, while AI-assisted processing generated the investigation report in 2–3 minutes. This does not mean that human expertise becomes redundant, but rather that the analyst’s time can be devoted to validation, decision-making, and higher-value-added tasks instead of mechanical data collection.

Not instead of people, but together with people

The future of the SOC will likely not be one of fully autonomous, unmanned operations. Rather, a hybrid model is emerging in which various agents support specific roles within the SOC: the analyst, the threat hunter, CTI processing, and even the preparation of management-level summaries.

These agents do not operate in isolation, but rather collaborate, share context, and complement each other’s results. This is no longer simple automation, but the foundation of a new operational model.

Why is it worth implementing AI Analyst?

AI Analyst isn’t just another AI feature in the SOC; it’s an agentic AI solution that directly addresses one of the biggest challenges in security operations: how to investigate incidents faster, more accurately, and with less human effort, while ensuring that decision-making control remains firmly in the organization’s hands.

The business value of the solution quickly becomes tangible. It reduces the workload on analysts, shortens investigation times, reduces backlogs, improves the filtering of false positives, and generates standardized, ready-to-use reports. All of this translates not only to more efficient SOC operations but also to faster response times, better resource utilization, and a more measurable service level.

AI Analyst offers a real advantage to organizations that don’t just want to experiment with AI but are seeking a scalable, production-ready, and technically sound solution. A platform capable of analyzing the context of the entire SIEM environment, universally applicable, and providing meaningful support to the team even in the event of new incidents.

If the goal is for the SOC to not only handle more alerts but also validate more real threats in less time, then the AI Analyst module is not a future possibility but a solution available immediately.