From Investigation Failures to Reliable SOC Agents: Understanding and Improving LLM-Based Alert Triage
The study tested five different ways LLMs can triage security alerts using an interactive benchmark called ALERT-BENCH. It found that structuring evidence retrieval and decision review significantly boosts reliability, with a new multi-agent system, AIDA, achieving a high F1 score of 0.958. This means reliable alert triage requires systematic investigation and challenge rather than just advanced reasoning.