Getting Real Value from SIEM, SOAR and Security AI

The pattern is familiar. A SIEM is purchased, every log source anyone can find is connected, ingestion costs climb every month, and the analysts learn to ignore a queue of alerts that are mostly noise. Then someone proposes adding AI to make sense of it all. Automation and AI can multiply what a security team does, but only on top of good data and good detections. The order in which you build matters more than the products you choose.

Start with the data, not the license

Prioritize log sources by detection value, not by availability. For most organizations the first tier is the identity provider, endpoint detection and response, cloud control-plane logs, email security, and DNS and firewall telemetry from internet-facing systems. Business-critical applications follow. Verbose sources with little security value can be filtered, sampled or kept in cheaper storage.

• Normalize to a common schema, such as OCSF or the Elastic Common Schema, so a single detection works across vendors.
• Store timestamps in UTC and keep clocks synchronized. Correlation across sources depends on it.
• Monitor log source health. A source that silently stops sending is a blind spot an attacker will happily use.

Detection engineering as code

Detections deserve the same discipline as application code. Keep them in Git, review changes, test them, and deploy them through a pipeline. Sigma, a vendor-neutral rule format, lets you write a detection once and convert it to the query language of your SIEM. Map each rule to MITRE ATT&CK techniques so coverage gaps become visible, and validate rules against safe attack simulations such as Atomic Red Team.

title: Shell Spawned by Web Server Process
status: experimental
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    ParentImage|endswith:
      - '/nginx'
      - '/httpd'
      - '/java'
    Image|endswith:
      - '/sh'
      - '/bash'
  condition: selection
level: high
tags:
  - attack.persistence
  - attack.t1505.003

Track the true positive rate of every rule. A rule that fires daily and is closed as benign every time is training analysts to ignore it. Tune it, add context, or retire it.

Alert quality over alert volume

Risk-based alerting changes the unit of work from individual events to entities. Low-confidence signals add risk to a user or host instead of opening a ticket each, and an alert fires only when the combined risk crosses a threshold. Enrich every alert automatically with asset criticality, user role, recent authentication history and threat intelligence, so the analyst starts with context instead of a raw log line.

SOAR: automate the boring, gate the dangerous

Security orchestration, automation and response platforms run playbooks across your tools. Start with the highest-volume, lowest-risk work, where automation pays back fastest.

• Enrichment: reputation lookups, user and asset context, and related alerts attached before a human opens the case.
• Phishing triage: extract indicators from the reported email, check them, find the same message in other mailboxes, and queue it for removal.
• Containment with approval: isolating a host or disabling an account is prepared automatically and executed after one click from an analyst.
• Closure: known false positives closed with a documented reason, so trends can still be measured.

Keep a human in the loop for anything destructive or customer-facing. A playbook that disables the CEO's account at 2 a.m. because of a misconfigured rule will set the program back by a year.

Where security AI genuinely helps

• Summarizing an alert or incident from dozens of raw events into a readable narrative.
• Translating an analyst's question in plain language into a correct search query, which shortens hunting for junior staff.
• Clustering similar alerts so one decision can resolve many.
• Suggesting next investigation steps and drafting detection rules for an engineer to review.

Every one of these depends on the earlier layers. A model reasoning over inconsistent field names, missing log sources and noisy rules will produce confident nonsense. Treat AI output as a lead to verify, log every action an AI component takes, and do not let it execute containment without the same approval gates you apply to playbooks.

Keep the economics sane

Ingestion-priced SIEMs punish indiscriminate logging. Route data through a security data pipeline that filters and reduces it before it reaches the SIEM, keep 30 to 90 days in hot storage for investigation, and archive the rest in a cheaper data lake that can still be searched when an incident demands it. Measure cost per detection use case. It shows quickly which sources earn their keep and which only fill the bill.