Can automated responses to cyber incidents be supported by AI?
summary
Two practical proposals test whether automated incident response can use AI: label-based ML to cut false positives and LLMs to map free-text alerts into the ACN taxonomy (57 pages, 22 predicates, 144 values). A Splunk/SOAR pipeline runs playbooks in Python and accepts JSON containers; a local GPTOSS 20B on a notebook (4K context, no GPU) classifies synthetic incidents with partial correctness and hallucinations. Results need 200–300 examples for fine-tuning and prefer on‑premises deployment to avoid leaking sensitive alerts.
AI-written summary · about
chapters (6)
- 0:00Introduction to AI in cyber response
- 5:08Security information and event management
- 11:18Security orchestration automation and response
- 16:38ACN taxonomy for incident reporting
- 21:59Proposed AI integration solutions
- 26:11Q&A on AI and incident response
related talks
40mApplying Artificial Intelligence to the Incident Response Function
19mFrom Alerts to Action: AI-Powered Incident Response Systems
36mRisks and Opportunities of AI in Incident Management
30mAI and Incident Management: How to Reduce Manual Work and Speed up the Incident...
05mAI-Driven Incident Resolution – Hype or Reality
32mAI/Machine Learning: What is Actually Working in Cybersecurity?
20mAutomated Incident Management
26mAI & SRE: Embracing the Ultimate Frontier of Automation