Search papers, labs, and topics across Lattice.
This paper introduces an end-to-end LLM-based framework for automating security operations, encompassing threat detection, query generation, and incident resolution. The framework uses an ensemble of LLMs for threat detection, achieving 82.8% accuracy with a low false positive rate, and introduces the SQM architecture for syntax-constrained query generation, significantly outperforming baseline LLMs. By integrating SQM-derived evidence, the framework improves incident resolution code prediction accuracy to 90%, reducing average incident triage time to under 10 minutes in production.
LLMs, when carefully constrained and augmented with retrieval, can slash incident triage times from hours to minutes in real-world security operations.
Security Operations Centers (SOCs) face mounting operational challenges. These challenges come from increasing threat volumes, heterogeneous SIEM platforms, and time-consuming manual triage workflows. We present an end-to-end threat management framework that integrates ensemble-based detection, syntax-constrained query generation, and retrieval-augmented resolution support to automate critical security workflows. Our detection module evaluates both traditional machine learning classifiers and large language models (LLMs), then combines the three best-performing LLMs to create an ensemble model, achieving 82.8% accuracy while maintaining 0.120 false positive rate on SIEM logs. We introduce the SQM (Syntax Query Metadata) architecture for automated evidence collection. It uses platform-specific syntax constraints, metadata-based retrieval, and documentation-grounded prompting to generate executable queries for IBM QRadar and Google SecOps. SQM achieves a BLEU score of 0.384 and a ROUGE-L score of 0.731. These results are more than twice as good as the baseline LLM performance. For incident resolution and recommendation generation, we demonstrate that integrating SQM-derived evidence improves resolution code prediction accuracy from 78.3% to 90.0%, with an overall recommendation quality score of 8.70. In production SOC environments, our framework reduces average incident triage time from hours to under 10 minutes. This work demonstrates that domain-constrained LLM architectures with retrieval augmentation can meet the strict reliability and efficiency requirements of operational security environments at scale.
