Enterprise alert triage system keeps perfect recall with evolving security rules
REFINE: A Resilient Evolution Framework for Intelligent Enterprise Alert Triage in Security Operations Centers
Cryptography and SecurityArtificial IntelligenceMachine Learning
Summary
Security teams get overwhelmed with many alerts every day, making it hard to focus on real threats. The authors created REFINE, a system that uses smart language models combined with security expert know-how and feedback to always catch all important threats. REFINE adapts over time to a company’s changing security needs. It was tested on real security setups and kept its ability to never miss real threats, doing better than other similar systems.
What this means in practice
- •For cybersecurity teams: Automatically prioritize and close safe alerts while ensuring no real threats are missed in enterprise security operations.
- •For incident response teams: Improve alert handling by continually adapting triage criteria to evolving operational standards and expert feedback.
Authors
Huimin Chen, Quan Long, Yanhao Wang
Abstract
Security Operations Centers (SOCs) process large volumes of alerts daily. Alert triage prioritizes high-risk threats while reducing manual review of benign alerts. LLM agents can reason over logs and threat intelligence, but struggle to keep aligned with organization-specific, rapidly evolving SOC operational standards. We introduce REFINE, an LLM-agent framework for enterprise alert triage. REFINE encodes analyst expertise as structured skills and continuously adapts using analyst disposition feedback. It enforces recall = 1.0 as a hard constraint during evolution to maximize auto-closure of false positives, and identifies judgment blind spots by combining alert distributions with model error boundaries. Evaluated on four real industrial SOC scenarios across four MITRE ATT&CK phases with temporal split: REFINE achieves recall=1.0 on all evolution sets. On future test windows, it retains recall=1.0 in three scenarios; the degraded case reaches 0.807 recall, still outperforming self-evolution baselines (0.49-0.58).