LLM framework automates SOC operations, cutting triage time from hours to minutes

Researchers have developed an end-to-end framework designed to automate critical workflows within Security Operations Centers (SOCs). This system integrates an ensemble of large language models for threat detection, achieving 82.8% accuracy with a low false positive rate. It also features a novel architecture for generating precise queries across different SIEM platforms and enhances incident resolution by improving prediction accuracy from 78.3% to 90.0%. The framework significantly reduces incident triage time from hours to under 10 minutes, demonstrating the viability of domain-constrained LLMs in operational security. AI

Summary written by gemini-2.5-flash-lite from 1 source. How we write summaries →

IMPACT Automates SOC operations, reducing triage time and improving threat detection accuracy.

RANK_REASON Academic paper detailing a new LLM framework for security operations.

Read on arXiv cs.AI →

• arXiv
• LLM
• SIEM
• IBM QRadar
• Google SecOps

• paper
• product