Inside a SIEM, machine learning mostly does three jobs: it learns normal behaviour and flags departures, it groups related alerts into one case, and it ranks what an analyst should read first. Language models add summaries and query help. None of it replaces good logs or clear detections.
What problem does it address?
NIST SP 800-92 states the underlying difficulty. The number, volume and variety of computer security logs have increased greatly, and the work of generating, transmitting, storing, analysing and disposing of them must be managed. A SIEM centralizes and correlates, but rule based correlation only finds what someone wrote a rule for, and people cannot read the volume that results.
ML aims at that gap. It does not see more than the logs contain. It sorts and scores what is there.
Which ML techniques show up, and what are they good for?
Anomaly detection builds a baseline for a user, host or service, then flags deviations: a login at an odd hour, a first ever connection from a server to a new destination, an unusual amount of data leaving. This can catch behaviour no rule predicted. It also flags harmless change, such as a new project or a holiday, so the output needs tuning and a human decision.
Clustering and entity grouping join alerts that concern the same account or host across time, so five weak signals become one case with a timeline. This cuts duplicate triage and is often the quietest gain.
Supervised classification, trained on past analyst verdicts, estimates the chance an alert is a real incident. It is only as good as the labels. If past analysts closed things in a hurry, the model learns to do the same.
Language models help with summarizing a case, translating a plain question into a query, or drafting a report. They can state things confidently that the data does not support, so analysts should check summaries against raw events.
What can go wrong?
Training data quality decides everything. A model learns from the logs it was given, including gaps and mislabelled history. If an attacker was already present during the baseline period, their behaviour looks normal.
Opaque scores are hard to defend. An analyst told "risk 92" with no reason cannot judge it or explain it to a manager. Prefer systems that show which features drove a score.
Adversaries can adapt. Slow, low volume activity sits under a threshold. Treat ML as one layer, and keep deterministic detections for known techniques. MITRE ATT&CK gives a shared vocabulary for those: its Exfiltration tactic, for instance, describes techniques such as transfer over alternative protocols that a rule can target directly.
NIST's AI Risk Management Framework is voluntary guidance for building trustworthiness into the design, development, use and evaluation of AI systems, and applies to the model you are putting in your security stack as much as to any other system. The draft Cyber AI Profile from NIST has a focus area on conducting AI enabled cyber defense, which is this topic.
A constructed example
An analyst sees a case titled "Unusual database export." The ML layer grouped four alerts: a new service account, a query count above its baseline, a connection to a new external address, and a large outbound transfer. The language model summary says "likely data theft." The analyst checks the raw events and finds the account was created by a data team for a migration. The grouping saved an hour. The summary's verdict was wrong, and the raw data showed why.
How to check or apply this
- List the decisions you want help with: prioritizing, grouping, summarizing or hunting. Choose techniques per decision.
- Check what data the model uses and whether those logs are complete and clean.
- Require explanations. Each score should show the signals behind it.
- Run the ML output beside your current process for a few weeks and compare against analyst verdicts before relying on it.
- Keep deterministic rules for known attack techniques, and map them to ATT&CK.
- Track false positives, missed detections and time to close, and review them monthly.
- Decide where AI generated text may be used, and require a check against raw events before action.
Quick check
Will machine learning replace SIEM rules?
No. Rules catch known techniques reliably and explain themselves. ML helps with ranking, grouping and unknown behaviour. Most teams need both.
What is the biggest risk of ML in a SIEM?
Trusting a score you cannot explain, built on data you have not checked. Review explanations and test against analyst verdicts.
Sources
- NIST SP 800-92, Guide to Computer Security Log Management
- NIST AI Risk Management Framework
- NIST IR 8596 preliminary draft, Cyber AI Profile
- MITRE ATT&CK, Exfiltration tactic
Last reviewed: 18 October 2026.
