Command

SOC & Incidents

AI-triaged alert queue, incident response, threat hunting and detection engineering · NIST SP 800-61 lifecycle

Alerts · 24 h

12,480

from 41 sources

After AI triage

212

98.3% closed as noise with reasons

Waiting for an analyst

oldest 9 min

AI triage precision

0.94

recall 0.97 · weekly backtest

Queue

Alert	Title	Entity	Technique	Source	AI score	Status
AL-90412	Credential stuffing against /login	Client Portal	T1110.004	Edge + identity	0.97	Escalated
AL-90409	PowerShell from Excel	WS-0571	T1059.001	EDR	0.93	Contained
AL-90404	Push-bombing against RO officer	P•••• B••• u•••	T1621	Identity	0.91	Escalated
AL-90399	Signing key used at 02:14	goaml-sign-2026	—	HSM audit	0.41	Benign
AL-90396	New admin path scanner	GRC Platform	T1595.003	WAF	0.62	Triage
AL-90391	DNS tunnelling suspect	SRV-GOAML-2	T1071.004	DNS	0.77	Investigating

Triage model

P(true | evidence) = LR × prior / (LR × prior + (1 − prior))
LR = Π LR_i over independent signals            # e.g. TI hit 6.0, rare parent process 3.2
priority = P × asset criticality × identity privilege
auto-close if P < 0.15 with an explanation; escalate if P ≥ 0.85