What LLM-assisted alert triage actually looks like in a real SOC

Every security vendor now has an AI button. Most of them summarise an alert you could already read. That is not the interesting part, and it is not what we teach.

The workflow that actually reduces analyst load has three stages: enrichment, correlation, and drafting. Enrichment is where a model is genuinely good — given a raw alert, it can pull asset ownership, recent change tickets, threat intel context, and prior similar incidents into one coherent brief. That is a data-plumbing problem with a language interface on top, and it saves a Tier 1 analyst eight to twelve minutes per alert.

Correlation is harder and needs guardrails. We teach students to constrain the model to a fixed set of queries against their own telemetry rather than letting it reason freely about what might be related. The model proposes a hypothesis, a deterministic query validates it, and the result — not the model's opinion — goes into the case.

Drafting is where the time savings compound. An incident report that took forty minutes to write takes eight to review when the model produces the first pass from the case timeline. The analyst still owns the conclusions. They just stop retyping the facts.

The failure mode we drill hardest against is quiet confidence. A model that hallucinates an IP range in a containment recommendation is worse than no model at all. Every automation students build in this module has to pass an adversarial review where a classmate tries to make it produce a plausible wrong answer.

By the end of the block, each student has a triage pipeline running against their own lab telemetry, with evaluation metrics tracking how often the enrichment step is complete and correct. That pipeline goes straight into their portfolio, and it is consistently the thing interviewers want to talk about.