REDUCING SOC ANALYST ALERT FATIGUE THROUGH LLM-ASSISTED TRIAGE: A PROVIDER-AGNOSTIC SUMMARIZATION PIPELINE FOR WAZUH

Abstrak

The volume of alerts processed by Security Operations Centres (SOCs) often exceeds analysts’ capacity for sustained attention. Even lowpriority notifications require analysts to examine raw logs, interpret rule metadata, and make an initial determination as to whether an alert constitutes a true positive or a false positive. This contributes to alert fatigue and increases the risk that significant security events may be overlooked. This article presents an open-source, provider-agnostic system that uses a large language model to perform the initial triage of alerts generated by Wazuh 4.9.2. The system combines a severityprioritized summarization service with a read-only conversational assistant operating within the analyst’s existing access permissions. Importantly, the LLM component is isolated from the primary alerting pipeline; therefore, a model or provider failure does not affect Wazuh’s ability to detect and record threats. Engineering verification demonstrated that the system successfully passed all quality-control tests. However, because the accuracy of its conclusions was not evaluated against a human-labelled ground-truth dataset, the results confirm the system’s technical and operational feasibility rather than its absolute reliability in making final security decisions.