From Logs to Living Timelines: AI-Assisted Incident Response in Hybrid Cloud Using OCSF
summary
Claims a reproducible, schema-first pipeline (Ingest → Normalize → AI Assist → Validate → Timeline → Export) that converts fragmented AWS/Azure/SaaS/endpoint logs into living timelines using OCSF normalization, UTC timestamps, and LLMs for field inference and clustering. Architecture integrates with Splunk, Sentinel, Databricks, enriches via VirusTotal/OTX, exports CSV, and preserves original evidence with chain‑of‑custody hashes and hash verified transformations plus prompt versioning. Validation includes Daubert/Frye/Durant alignment, human‑in‑the‑loop review; demo uses synthetic data and costed three log sources at ~$3 in tokens.
AI-written summary · about
chapters (19)
- 0:00Introduction to AI-driven incident response
- 2:07Learning new threats with AI-generated logs
- 3:34AI-assisted case handling review
- 4:57Challenges in inconsistent log documentation
- 6:00Maturity model for AI adoption in SOCs
- 7:24Risks of shadow AI in security operations
- 8:50Standards for evidentiary reliability in timelines
- 10:59Why OCSF for log normalization
- 12:45Technical deep dive into the timeliner solution
- 17:02Human-in-the-loop validation in AI tools
- 20:15Preserving evidence integrity with AI
- 22:48Compliance and audit readiness in AI solutions
- 25:23Logging AI tools for detection and audits
- 26:49MITRE ATT&CK mapping with AI clustering
- 27:53Operational speed and token cost efficiency
- 28:57Human-centered AI for security analysts
- 29:39Regenerating timelines with AI for investigations
- 31:02Trust and accountability in AI security tools
- 31:46Q&A and closing remarks
related talks
22mUse generative AI and Amazon Security Lake to enhance threat analysis
13mStreamline security operations and improve threat detection with OCSF
50mTo Normalized Logs, and Beyond - Building a Threat Detection...
34mCan automated responses to cyber incidents be supported by AI?
17mUnifying Your Security Data with Amazon Security Lake and OCSF
19mOCSF for security at the edge with AWS AppFabric and Barracuda XDR
25mBeyond Human Scale: AI and Automation as Force Multipliers in Cyber Threat Intelligence
19mFrom Alerts to Action: AI-Powered Incident Response Systems