An LLM can help triage security alerts by summarizing them, pulling in context and suggesting a priority, but a person should still own the closing decision. It reads text well and reasons loosely. It does not know your environment unless you give it that context, and it can be wrong in confident prose.
What triage actually involves
Triage is a short chain of questions. Is this alert real? What asset and identity are involved? Is it expected behavior? How bad is it if it is real? What should happen next?
Each question needs different inputs: the alert, surrounding logs, an asset inventory, user context and past tickets. A language model only handles the parts that arrive as text in its prompt, so the quality of triage is mostly the quality of the context you assemble.
Where an LLM helps
Three jobs fit well.
Summarizing. Raw alerts are often dense JSON. A model can restate one in plain words, which saves an analyst the first minute of reading.
Enrichment drafting. Given a hostname, a user and a process name, a model can propose which questions to ask next. Your own code should do the actual lookups, so the facts come from systems of record and not from model memory.
Grouping. Many alerts describe one event. A model can suggest that five alerts belong together, and an analyst can accept or reject the grouping.
Where it fails
It can state things that are not in the data. It can miss the one odd field in a long record. It can be steered by text inside the alert itself, which is a real risk covered in prompt injection in SOC AI assistants.
It also has no memory of what is normal for your company. A scheduled job that looks alarming to a stranger may be routine for you, and a model with no baseline will flag it.
A setup that holds up
Keep the model on a narrow task and keep the decision outside it.
- Let code fetch facts. Give the model the results as labeled fields.
- Ask for a structured output, such as a priority and a short reason, and validate it with deterministic code.
- Show the analyst the evidence next to the model's summary, not instead of it.
- Keep any action that changes a system behind human approval. See how much autonomy an AI SOC agent should have.
- Record what the model saw and what it said, so you can review mistakes later.
This follows the mitigations OWASP lists for LLM applications: constrain the task, validate output formats in code, use least privilege and require human approval for high-risk actions.
How to know it is working
Do not judge it by how fluent the summaries sound. Sample closed tickets, compare the model's suggested priority with what a senior analyst decided, and count the misses that mattered. Metrics for AI alert triage covers what to track.
Quick check
Should an LLM close low severity alerts automatically?
Only after you have measured its misses on a sample of those exact alert types and decided the risk is acceptable. Start with suggestions that an analyst confirms.
Is a bigger model always better at triage?
Not necessarily. Missing context and untrusted input cause more errors than model size. Fix the inputs first.
Sources
Last reviewed: 19 October 2026.
