SOC alert triage

• Every alert is enriched on arrival: asset owner and criticality, the user's role and recent sign-ins, threat intelligence on indicators, and recent related activity, all from read-only tools.
• Related alerts on the same user, host or indicator are grouped into one probable incident, with a timeline and the MITRE ATT&CK techniques they suggest.
• Each group gets a drafted triage summary: what happened, what it might mean, what's missing, a suggested severity with reasons, and the next steps from your own runbooks.
• Containment options, such as isolating a host or disabling an account, are drafted for the analyst. A workflow carries them out only after the analyst approves, and high-impact actions need the incident lead too.
• Possible personal data breaches and possibly reportable incidents are flagged early, with the evidence and timestamps, to the people who decide on reporting.
• The agent can't close or downgrade any alert. It can mark low-severity alerts as likely benign for an analyst to review in bulk, and high and critical alerts always get a full analyst review.

• NCSCCyber Assessment Framework v4.0 (August 2025)
  →

  The CAF is the standard NIS regulators use. Version 4.0 raised the bar on security monitoring and on detecting abnormal behaviour, and covers AI-related risk throughout. A triage agent supports objective C (detecting cyber security events) and D (minimising impact). It's also a new system in your estate, so it needs its own access control (B2), logging and a place in your incident response plan.

• Competent authorities / ICONIS Regulations 2018: incident reporting, where they apply
  →

  Operators of essential services must tell their competent authority about incidents with a significant effect on the essential service without undue delay and within 72 hours of becoming aware. Relevant digital service providers report substantial incidents to the ICO. The agent flags incidents that may meet your thresholds and drafts the facts. A named person decides when the organisation is aware and whether to report.

• ICOUK GDPR Articles 33 and 34: personal data breaches
  →

  A breach likely to risk people's rights and freedoms must be reported to the ICO within 72 hours of becoming aware of it, and people told without undue delay if the risk is high. Every breach must be recorded, reported or not. The agent flags alerts that touch personal data and drafts the breach record. The DPO decides on reporting. SOC data is also personal data about staff, so do a DPIA and keep it in UK regions.

• NCSC'Prompt injection is not SQL injection' (8 December 2025) and 'Managing the cyber risk of agentic AI' (interim advice, 20 August 2026)
  →

  Alert text is attacker-controlled input. The NCSC advises limiting impact rather than hoping to block every injection: the agent's own identity, least privilege, short-lived credentials, protected logs and an emergency stop. Here the agent's tools are read-only, containment runs in a separate approved workflow, and the agent's own activity is monitored by the SOC.

• Government / ETSIAI Cyber Security Code of Practice (DSIT, January 2025) and ETSI EN 304 223 (January 2026)
  →

  A voluntary baseline of 13 principles for securing AI systems, including threat modelling, human oversight and monitoring. Use it to assure the triage agent like any other security tool, and ask the same of any supplier's AI features.

On a phone, the table shows the platform you pick. Sovereign / on-prem means open, portable components you can run in your own data centre or with a UK or European provider; IONOS is shown as one example, and others exist. What sovereign cloud means →

• The SOC manager owns the agent's runbook index, prompts and tool list, with change control. Security architecture reviews every new tool before it's added.
• Analysts can split or merge a group, change the suggested severity and reject a summary with one action, and each correction is fed back.
• A second analyst reviews a weekly sample of alerts the agent marked likely benign, and every miss is investigated.
• Red-team tests for the agent: alerts with injected instructions in file names, command lines and email subjects, run before go-live and after every change.
• Clear owners for reporting decisions: the DPO for personal data breaches, the NIS lead for NIS incidents, with the 72-hour clock started by them, not by the tool.
• Analysts keep their skills: rotate who works without the drafts, and train new analysts on raw alerts first.

1. 3–4 weeks

   Discovery

   Measure today's alert volumes, time to triage and time per alert. Pick three to five high-volume alert types. Agree the read-only tool list and containment boundary with security architecture.

2. Gate · must be true to passBaseline measured, tool list approved, DPIA started, reporting owners named.

3. 10–12 weeks

   Pilot

   Enrichment, grouping and summaries in shadow mode for the chosen alert types. Analysts work as normal and compare.

4. Gate · must be true to passMissed true positives and grouping errors within agreed limits, all injection tests contained by the platform, SOC manager signs off.

5. 4–6 weeks

   Production

   Summaries and likely-benign marking live for the pilot alert types, with containment drafts and the approved containment workflow.

6. Gate · must be true to passSupport model in place, analysts trained, agent logs monitored by the SOC, emergency stop tested.

7. Ongoing

   Scale

   More alert types, longer look-backs through the data lake, and the same pattern for threat hunting notes and post-incident reviews.

8. Gate · must be true to passEach new alert type passes the same shadow gate; each new tool passes its own security review.

R ResponsibleA AccountableC ConsultedI Informed· not involved

Where I'd fit

1. 1

   Goes wrong

   A malicious file name tells the agent the alert is a test, and it closes it.

   How the design avoids it

   The agent has no tool to close or downgrade alerts, rules outside the model set the minimum review, and injection tests run before go-live.

2. 2

   Goes wrong

   The agent is given an analyst's SIEM account, with rights to edit rules and suppressions.

   How the design avoids it

   Its own identity, read-only named queries through a gateway, and the account reviewed like any other privileged one.

3. 3

   Goes wrong

   Grouping hides a second, separate attack inside a noisy incident.

   How the design avoids it

   Analysts can split groups, splits are measured, and critical assets are never grouped away.

4. 4

   Goes wrong

   Analysts start trusting the summary and stop reading the evidence.

   How the design avoids it

   Evidence shown beside every summary, a weekly second review, and regular work without the drafts.

5. 5

   Goes wrong

   The 72-hour clock for a breach report started days before anyone noticed.

   How the design avoids it

   Early flags to named owners, with timestamps, and the owners decide when the organisation became aware.

1. Late 2026–2028
   The Cyber Security and Resilience Bill is going through Parliament. As introduced, it adds an initial notification within 24 hours and a full report within 72 hours, with the NCSC told at the same time as the regulator, and brings managed service providers and data centres into scope. Detail follows in secondary legislation.

   Build reporting thresholds and timers as configuration, and make the agent's draft hold the facts a 24-hour notice will need. If an outside provider runs part of your SOC, check its new duties.

2. Next CAF version
   The NCSC has said it is developing the next version of the CAF to align with the Bill.

   Map the triage agent and its controls to CAF v4.0 now, so the next update is a review, not a rebuild.

3. 31 March 2027
   Microsoft Sentinel will no longer be supported in the Azure portal, only in the Defender portal.

   If you use Sentinel, build the agent's integration against the APIs and workflows that carry on after the move, not the Azure portal experience.

4. Formal guidance expected
   The NCSC says formal guidance will replace its interim advice on managing the cyber risk of agentic AI (August 2026).

   Build to the interim advice now: the agent's own identity, least privilege, protected logs and a tested emergency stop.

5. 2028
   The NCSC's post-quantum cryptography milestone: a full migration plan by 2028.

   Record the cryptography on the alert feeds, the gateway and the private links, and choose components where it can be updated.