From Investigation Failures to Reliable SOC Agents: Understanding and Improving LLM-Based Alert Triage
4.00T1 sourcearXiv cs.MA
Source record
Published by arXiv cs.MA (T1 source). The original is at https://arxiv.org/abs/2610.10608.
Pipeline notes
The summary and note below are generated by the signal pipeline — they are Beyond Desk’s reading, not quotations from the source.
SummaryPaper studies five LLM-based alert triage strategies for security operations centers using a new ALERT-BENCH benchmark replaying 1,247 enterprise alerts. All approaches missed over 40% of attacks. The proposed AIDA multi-agent framework, with adversarial investigation, dialectical challenge, and an append-only Investigation Ledger, raises F1 to 0.958 and reduces false negatives to 3.1%.
Why it mattersConcrete trace-level evidence of why LLM agent investigations fail (empty searches, weak dismissal criteria) plus a reusable structural pattern — separate challenge context and a Judge — for high-stakes agent decisions.
Cited by
No citations on record.