An LLM-Augmented SIEM Architecture for Automated Incident Handling and Knowledge-Graph-Grounded False-Positive Triage

Document Type

News Article

Publication Date

Fall 9-28-2026

Abstract

Security Operations Centres are under sustained pressure from alert volumes that exceed analyst capacity, and false positives consume a large share of triage time. This paper presents a non-invasive framework that augments an existing Rapid7 InsightIDR deployment with three downstream modules. SOCAI performs end-to-end incident handling using a GPT-40-mini model grounded through BERT-based retrieval-augmented generation over a corpus of 3,500 historical cases. DefMon detects web defacement through a dual-gate scheme that combines SHA-256 content hashing with Structural Similarity Index comparison. A knowledge-graph, retrieval-augmented triage agent, built on Neo4j and MITRE ATT&CK, suppresses likely false positives before the LLM pipeline is invoked. A prospective A/B study on 1,000 production incidents from a commercial managed security service provider recorded a mean handling time of 74 seconds, a Good or Excellent quality rate of 77.0 percent, and clear comprehensibility for 93.0 percent of reports, with inter-rater agreement of 0.85 for quality and 0.87 for clarity. A Pearson chisquare test on the full 4 by 7 quality-by-type contingency table confirmed that quality differences across incident types were highly significant. A 150-case pilot of the triage agent achieved 86.7 percent suppression with zero false negatives. Over 129,600 monitoring checks across fifteen production web properties, DefMon produced no false positive. External validity is limited by single-site evaluation, which motivates cross-organisational replication as the next step.

Link to Full Text

Share

COinS