AI-BASED SOC ASSISTANT FOR EVENT CORRELATION, LOG ANALYSIS, AND THREAT DETECTION

Author

Tamada Mohan Krishna, Pullari Sailaja, Seeramreddi Gowtham Kumar, Ponnana Dilli Babu, M Harshavardhan

Abstract

 Security Operations Centers (SOCs) process large volumes of endpoint, network, identity, and application telemetry. This paper presents an AI-Based SOC Assistant that combines telemetry ingestion and normalization, temporal event correlation, deterministic threat detection, incident management, AI-assisted investigation, and analyst-facing presentation. The project architecture identifies Splunk Boss of the SOC (BOTS) v1 CSV data (15.8 GB and approximately 13.4 million rows) and a sample JSONL collection (1,508 events) as input sources; these are source-inventory figures and do not establish that the entire BOTS dataset was processed in a benchmark run. Events are parsed, validated using a Pedantic schema, and stored in SQLite. Four correlation strategies group activity by source IP, user, multiple destination ports, and authentication sequence, using configured sliding windows described in the technical dossier as 300–600 seconds. A deterministic engine specifies seven MITRE ATT&CK-mapped detection categories: brute force (T1110), suspicious successful logon (T1078), privilege escalation (T1068), suspicious process execution (T1059.001), port scanning (T1046), lateral movement (T1021), and unauthorized service installation (T1543.003). Related detections are grouped into incidents with severity and lifecycle tracking. A local Ollama model (Qwen 2.5 7B or Llama 3) supports evidence-based summaries and remediation guidance, with an expert fallback described in the project specification. The Stream lit dashboard presents Command Center, AI Workbench, and Telemetry Explorer views through a Fast API service. The technical dossier reports performance measurements, but they are reproduced here as reported values rather than independently verified results. Consequential response actions require authorization, safeguards, and analyst approval.

Keywords

Security Operations Center, SIEM, SOAR, Event Correlation, Log Analysis, Deterministic Threat Detection, Large Language Models, Ollama, MITRE ATT&CK, Incident Management.

Full Text:

Download Paper PDF

References

[1] I. Kotenko, D. Gaifulina, and I. Zelichenok, “Systematic Literature Review of Security Event Correlation Methods,” IEEE Access, vol. 10, pp. 43387–43420, 2022, doi: 10.1109/ACCESS.2022.3168976.

[2] G. Palma, G. Cecchi, M. Caronna, and A. Rizzo, “Leveraging Large Language Models for Scalable and Explainable Cybersecurity Log Analysis,” Journal of Cybersecurity and Privacy, vol. 5, no. 3, Art. no. 55, 2025, doi: 10.3390/jcp5030055.

[3] R. Vaarandi and H. Bahşi, “Using Large Language Models for Template Detection from Security Event Logs,” International Journal of Information Security, vol. 24, Art. no. 104, 2025, doi: 10.1007/s10207-025-01018-y.

[4] Ismail, R. Kurnia, F. Widyatama, I. M. Wibawa, Z. A. Brata, Ukasyah, G. A. Nelistiani, and H. Kim, “Enhancing Security Operations Center: Wazuh Security Event Response with Retrieval-Augmented-Generation-Driven Copilot,” Sensors, vol. 25, no. 3, Art. no. 870, 2025, doi: 10.3390/s25030870.

[5] R. Singh, S. Tariq, F. Jalalvand, et al., “LLMs in the SOC: An Empirical Study of Human-AI Collaboration in Security Operations Centres,” arXiv preprint arXiv:2508.18947, 2025. [Online]. Available: https://arxiv.org/abs/2508.18947.

[6] S. Srinivas, B. Kirk, J. Zendejas, M. Espino, M. Boskovich, A. Bari, K. Dajani, and N. Alzahrani, “AI-Augmented SOC: A Survey of LLMs and Agents for Security Automation,” Journal of Cybersecurity and Privacy, vol. 5, no. 4, Art. no. 95, 2025, doi: 10.3390/jcp5040095.

[7] M. Kazi and S. Poinkar, “An Explainable AI Based Alert Triage Framework for Security Operations Centres: Architecture, Evaluation, and Analyst Centered Design,” InfoTech Spectrum: Iraqi Journal of Data Science, vol. 3, no. 2, pp. 67–78, 2026, doi: 10.51173/ijds. v3i2.84.

[8] C. V. Garware and S. N. Zisad, “OpenSOC-AI: Democratizing Security Operations with Parameter Efficient LLM Log Analysis,” arXiv preprint arXiv:2604.26217, 2026, doi: 10.48550/arXiv.2604.26217.

[9] “A Blockade-Detection-Response (BDR)-Based Security Operations Center Dashboard Design,” Computers in Human Behavior Reports, vol. 4, Art. no. 100143, 2021, doi: 10.1016/j.chbr.2021.100143.

[10] H. Zhang, H. Wang, H. Tan, L. Zeng, J. Li, and Z. Gu, “From Ambiguous Queries to Verifiable Insights: A Task-Driven Framework for LLM-Powered SOC Analysis,” IET Intelligence Technology, first published May 4, 2026, doi: 10.1049/cit2.70138.

[11] H. Maosa, K. Ouazzane, and M. C. Ghanem, “A Hierarchical Security Event Correlation Model for Real-Time Threat Detection and Response,” Network, vol. 4, no. 1, pp. 68–90, 2024, doi: 10.3390/network4010004.

Share your valuable work from Social Media Buttons