SOC alert triage assistant pilot for a Phoenix managed service provider
Managed service provider, Phoenix
- Challenge
- The provider's small security operations team received around 2,000 alerts a day across client tenants. Analysts spent most of each shift closing false positives, genuine alerts waited in the same queue, and the provider had lost two analysts to burnout in a year.
- Solution
- A nine-week MVP: an assistant enriches each alert with asset, user and threat-intelligence context, proposes a classification with its reasoning, and groups related alerts. Analysts accept or override every proposal; overrides are reviewed weekly to tune the rules. The assistant never closes an alert itself.
- Results
- Analyst time on false positives reduced by 45%
- Median time to acknowledge a genuine alert down to 6 minutes
- Pilot extended to all 14 client tenants