IJNSA 01

SOC using AI: Design and End-to-End Validation of an AI-Assisted Security Operations Center

Hashim Jarrar, Ahmad Aldarawish and Hatem Al-Kishawi, Middle East University, Jordan

Abstract

SOC using AI is an integrated Security Operations Center that combines deterministic detection with controlled AI assistance. Windows telemetry is collected through Sysmon and the Wazuh Agent, while Zeek and Suricata provide network visibility. Wazuh performs first-stage decoding and rule evaluation. A Python watcher selects newly generated security-relevant alerts, suppresses duplicate analysis, invokes local Ollama assistance, performs public-IP reputation checks through AbuseIPDB when appropriate, correlates related evidence, and stores incident data in SQLite for FastAPI and dashboard access. The wider platform also includes a CICIDS2017-oriented inference service with Random Forest, XGBoost, and Decision Tree artifacts; this ML service is a supporting component and is not presented as quantitatively benchmarked in this paper. Controlled host and network tests operationally verified the core event-toincident path, database integrity, agent connectivity, and service health. The reported results are limited to evidence observed in the final laboratory environment and do not constitute a statistical performance benchmark.

Keywords

Security Operations Center, Wazuh, Artificial Intelligence, Machine Learning, Incident Correlation

1. INTRODUCTION

Security Operations Centers depend on evidence from endpoints, network sensors, authentication systems, applications, and infrastructure. The operational challenge is not only to collect this information, but to preserve its source, identify security-relevant activity, and give analysts enough context to investigate efficiently. NIST describes intrusion detection and prevention as a combination of host-based, network-based, and complementary monitoring technologies [1]. SOC using AI follows this layered approach.

The project was implemented as a containerized SOC environment rather than as a stand-alone classifier or dashboard. Its validated core connects Windows endpoint telemetry, Zeek and Suricata network monitoring, Wazuh SIEM/XDR processing, project-specific detection rules, a Python watcher and analysis pipeline, local Ollama assistance, conditional AbuseIPDB
enrichment, incident correlation, SQLite persistence, FastAPI, and an analyst-facing dashboard. The repository also contains supporting services for machine-learning inference, response workflows, feedback, and monitoring.

A central design choice is that Wazuh remains the detection authority. AI receives selected alerts only after rule evaluation. It explains, prioritizes, and suggests investigation steps, but it does not turn raw telemetry into an authoritative alert by itself. This keeps the original evidence traceable and allows Wazuh to continue collecting and detecting if an AI service is unavailable.

1.1. Problem and Contribution

The project addresses the gap between collecting many security events and turning them into amanageable incident workflow. In a manual process, analysts may need to search SIEM data,
inspect endpoint logs, consult network sensors, query reputation services, and assemble notes
separately. SOC using AI links these activities in one path: telemetry is detected deterministically, selected alerts receive controlled AI and threat-intelligence context, related
evidence is correlated, and the resulting incident is stored and exposed through the same analyst interface. The contribution is therefore architectural and operational: integration, traceability, and analyst support are treated as one system rather than separate demonstrations.

2. TECHNOLOGY BASIS AND PROJECT SCOPE

2.1. Endpoint and SIEM Monitoring

Sysmon records detailed Windows activity such as process creation, network connections, and
file-related events [2]. The Wazuh Agent forwards host evidence to the central Wazuh environment, where decoders and rules normalize events and determine whether an alert should be generated [3]. This arrangement provides a stable host-to-SIEM path and retains the original rule identifier, severity, timestamp, and event data for later investigation.

2.2. Network Security Monitoring

Zeek and Suricata serve different purposes in the network-monitoring layer. Zeek produces structured metadata for connections and application protocols, including DNS, HTTP, and TLS, and records unusual protocol behavior [4]. Suricata adds signature-oriented IDS/IPS and network-security-monitoring capability [5]. The project uses them as complementary sensors rather than interchangeable tools.

2.3. AI, Machine Learning, and External Context

The local language-model layer runs through Ollama [6]. It is used after Wazuh detection to translate alert evidence into an analyst-friendly explanation, provide investigation context, and suggest reasonable next actions. The project also contains a machine-learning inference service built around Random Forest, XGBoost, and Decision Tree artifacts for CICIDS2017-style network-flow input. The implemented service contract expects 77 features. Because the final endto-end validation did not reproduce a controlled labeled benchmark for those artifacts, this paper describes the ML service as an implemented supporting capability and does not repeat accuracy or latency claims that were not re-measured in the final environment.

Threat-intelligence enrichment uses AbuseIPDB APIv2 [7]. Before an external lookup, an indicator is classified as publicly routable or internal. Private, loopback, and other internal addresses are not submitted. This minimizes disclosure of internal addressing and avoids sending indicators for which public reputation has no meaningful value. MITRE ATT&CK is used as a behavioral vocabulary for selected detections and investigation context, not as a replacement detection engine [8].

2.4. Related Work and Project Positioning

Research on intrusion detection has long examined machine-learning methods for separating benign and malicious activity. Buczak and Guven survey data-mining and machine-learning approaches for cyber intrusion detection [9], while Sommer and Paxson caution that operational network intrusion detection differs substantially from closed-world classification [11]. More recent work has moved toward AI-assisted SOC operations. A 2024 SIEM study highlights the continued role of SIEM platforms as the operational aggregation and response layer, including their convergence with analytics [15]. AACT learns from analyst triage decisions to prioritize or close alerts and reports evaluation on real SOC and open data [16]. Cognitive SOC uses specialized LLM agents to transform alerts into evidence-backed narratives and explicitly evaluates evidence linkage, citations, hallucination, and time-to-recommendation [17]. CORTEX similarly frames LLM alert triage as collaboration among specialized agents operating over enterprise evidence [18]. These systems emphasize automated triage or agentic reasoning; SOC using AI instead focuses on an evidence-preserving integration boundary in which deterministic Wazuh rules remain the detection authority and AI output is advisory context attached to, rather than substituted for, the original alert.

The contribution is therefore not the invention of a new detector or foundation model. It is the implemented and inspectable workflow that joins endpoint and network telemetry, deterministic SIEM detection, controlled alert selection, duplicate suppression, conditional public-IP enrichment, local LLM assistance, incident correlation, persistence, API access, and an analystfacing interface while preserving provenance. This differs from approaches that place an AI model directly in the decision path: the Wazuh alert remains independently auditable, external enrichment is data-minimized, and generated recommendations do not autonomously trigger containment. Table 1 summarizes the practical positioning against representative recent work. Online sources for the representative studies discussed above: SIEM study [15]; AACT [16];Cognitive SOC [17]; CORTEX [18].

Table 1. Positioning against representative recent AI/SIEM security work.

3. SYSTEM DESIGN

3.1. Layered Architecture

The implemented path begins at the sensors. Windows endpoints provide Sysmon and Wazuh
Agent telemetry; Zeek and Suricata provide network evidence. Wazuh performs decoding, rule evaluation, and alert generation. The Python AI engine then watches newly generated alerts, filters them by rule and level, suppresses repeated analysis, and forwards accepted alerts to the remaining analysis stages. Local AI, public-IP enrichment, correlation, persistence, FastAPI, and the dashboard sit behind this deterministic boundary.