AI Cybersecurity Agent Development

Description

Our SOC is three analysts covering a 24/5 rota, and the honest problem is volume: roughly 800 alerts a day, of which maybe fifteen matter. The team triages by pattern-matching and fatigue, and we have missed things. We want an agent that does first-pass triage — enrich the alert, pull the related events, check the asset's exposure, and write a two-line assessment with a confidence. It does not close alerts. It does not take action. It writes the note an analyst would have written, so the analyst starts from a summary instead of a raw event. We will judge this on the false-negative rate, not the deflection rate. An agent that confidently downgrades a real intrusion is worse than no agent, and we will test it against six months of labelled historical alerts before it touches the live queue.

• Build alert enrichment against our SIEM, asset inventory and threat-intel feeds
• Produce a written assessment with an explicit confidence and the evidence it used
• Keep the agent strictly read-only — no closing, no blocking, no ticket state changes
• Backtest against six months of labelled alerts and report false negatives by severity
• Expose a per-assessment feedback control so analysts can correct it in the flow

• Triage agent integrated with the SIEM alert queue, read-only
• Backtest report against labelled history, broken down by alert severity
• Analyst feedback loop and a weekly disagreement review
• Deployment and rollback runbook