AI Decision Models Can Speed SOC Triage, but Reliable Verdicts Depend on Context
Summary
A contributed article argues that AI decision models could make SOC triage faster and more auditable, but reliable verdicts require forensic evidence and up-to-date knowledge of an organization’s normal activity.
Key points
- Decision models return structured choices and probabilities that can support automated triage, but well-formed outputs can still be wrong.
- The article says model calibration depends on input quality: alert labels alone may omit crucial endpoint evidence.
- In the contributor’s 2025 data, 82,000 alerts received live memory scans; about 2,600 machines had active infections, and 51% of those had been reported as mitigated by EDR.
- The contributor reports that nearly 1% of real incidents traced to the lowest-severity alerts, making severity-only triage risky.
- The article recommends gathering forensic evidence and current organizational context, then comparing verdicts with outcomes and updating that context.
- The contributor says its platform investigated more than 25 million alerts in 2025, with fewer than 2% escalated to humans; these are company-reported results.
Article Details
- Topic
- Decision models in AI SOC platforms, and the importance of forensic evidence and organizational context for reliable alert triage.
People
Vendors
Criblthinking. OpenAI announced its own Decisions API at DevDay and opened a public beta on October 6. Cribl published cribl-decision, an open LoRA adapter you can run locally. Others, like Laya, are already showingIntezerNote: This article has been written and contributed by Zev Schonberg, PMM at Intezer.OpenAIJev on September 15 and called it a System One model, a nod to Kahneman's fast, intuitive thinking. OpenAI announced its own Decisions API at DevDay and opened a public beta on October 6. Cribl publishedTypeSafe AIIn the space of a month, a new category of AI model went from nonexistent to everywhere. TypeSafe AI released Jev on September 15 and called it a System One model, a nod to Kahneman's fast, intuitive thinking. OpenAI
Products
cribl-decisionannounced its own Decisions API at DevDay and opened a public beta on October 6. Cribl published cribl-decision, an open LoRA adapter you can run locally. Others, like Laya, are already showing up in open sourceDecisions APIcalled it a System One model, a nod to Kahneman's fast, intuitive thinking. OpenAI announced its own Decisions API at DevDay and opened a public beta on October 6. Cribl published cribl-decision, an open LoRA adapterEndpoint Scannerfor a verdict, or there are signs of a fileless attack or code injection, the platform runs our Endpoint Scanner on the machine. It's a single executable with nothing to install. It collects process trees,Genetic AnalysisCode-level evidence. Our Genetic Analysis technology compares every piece of binary code running in memory against a large database of trusted and malicious code. It catches known malware, and it also catches new codeJevthe space of a month, a new category of AI model went from nonexistent to everywhere. TypeSafe AI released Jev on September 15 and called it a System One model, a nod to Kahneman's fast, intuitive thinking. OpenAILayabeta on October 6. Cribl published cribl-decision, an open LoRA adapter you can run locally. Others, like Laya, are already showing up in open source tooling.Org BrainOrganizational memory. Org Brain is our answer to the "what's normal here" problem. It keeps two kinds of memory. One is procedural, how your team investigates and which detections it closes on sight. The other is
Tools
Cobalt StrikeThe most common families we found in memory last year were tools like Mimikatz, Meterpreter and Cobalt Strike. These are built to live in memory, which is exactly where a file-based "quarantined" status can't see.Meterpreterextra attention. The most common families we found in memory last year were tools like Mimikatz, Meterpreter and Cobalt Strike. These are built to live in memory, which is exactly where a file-based "quarantined"Mimikatzrow deserves extra attention. The most common families we found in memory last year were tools like Mimikatz, Meterpreter and Cobalt Strike. These are built to live in memory, which is exactly where a file-based