From Investigation Failures to Reliable SOC Agents: Understanding and Improving LLM-Based Alert Triage

The paper introduces ALERT‑BENCH, a benchmark that simulates enterprise security telemetry and evaluates how large‑language‑model agents triage alerts. Five common reasoning strategies—single‑pass tool use, iterative retrieval, sampled investigations, self‑review, and explicit verification—were tested on 1,247 alerts from a multi‑stage attack scenario, each missing at least 40.4% of attack‑related alerts. Building on these findings, the authors propose AIDA, a multi‑agent framework that enforces explicit decision proposals, independent challenges, and stronger evidence requirements, achieving an F1 score of 0.958 and reducing false‑negative alerts from 40.4% to 3.1% while escalating 18.4% to analysts.

Machine-generated by The Flow from the publisher's headline and feed description — not written or checked by a human. The full article lives at arXiv AI.

• llms
• agents
• benchmarks
• safety