AI decision models reshape SOC alert triage; Intezer argues forensic and organizational context matters more than the model
Decision models, which return typed verdicts with calibrated probabilities instead of generated text, have appeared quickly: TypeSafe AI released Jev on September 15, OpenAI opened a Decisions API public beta on October 6, and Cribl published the open LoRA adapter cribl-decision. This vendor-contributed piece by Intezer argues these models make triage of every alert cheap, fast and auditable. It also argues that a calibrated model is only as good as its input, because alert metadata alone misleads. Intezer's AI SOC Report 2026 (25 million alerts triaged in 2025) is cited as showing that 51% of endpoints with active infections found by memory scan had already been reported as mitigated by the EDR. The article is a product-oriented opinion piece, not an incident report, and carries no direct threat to defenders.
Technical Details
- Intezer's data: of 82,000 alerts that went through a live memory scan, about 2,600 machines had an active infection, and 51% of those were already marked mitigated by the EDR.
- The most common families found in memory were Mimikatz, Meterpreter and Cobalt Strike, tools built to live in memory where file-based "quarantined" status cannot see them.
- Nearly 1% of real incidents traced back to lowest-severity alerts (roughly 54 real threats a year at 450,000 alerts).
- 74% of identity alerts were classified as likely benign; impossible travel alerts were confirmed as compromise only about 2% of the time, and VPN usage drove around 30% of them.
- Jev is priced at $42 per billion input tokens, with responses in 70-500 ms. Cribl's model card admits the model can be overconfident and sensitive to prompt wording.
- The vendor's claimed results: over 25 million alerts investigated, under 2% escalated to humans, 98% verdict accuracy, median triage time under a minute (self-reported, not independently verified).
Remediation
- Collect evidence (process trees, detonation results, memory contents) before making a verdict.
- Do not let severity decide which alerts get investigated.
- Treat organizational knowledge (assets, users, normal behavior) as a continuously refreshed system.
- Measure calibration in your own environment by tying automated verdicts to outcomes and watching for drift.
Linha do tempo
-
AI decision models reshape SOC alert triage; Intezer argues forensic and organizational context matters more than the model
ler a análise desta fonte ocultar
Decision models, which return typed verdicts with calibrated probabilities instead of generated text, have appeared quickly: TypeSafe AI released Jev on September 15, OpenAI opened a Decisions API public beta on October 6, and Cribl published the open LoRA adapter cribl-decision. This vendor-contributed piece by Intezer argues these models make triage of every alert cheap, fast and auditable. It also argues that a calibrated model is only as good as its input, because alert metadata alone misleads. Intezer's AI SOC Report 2026 (25 million alerts triaged in 2025) is cited as showing that 51% of endpoints with active infections found by memory scan had already been reported as mitigated by the EDR. The article is a product-oriented opinion piece, not an incident report, and carries no direct threat to defenders.
Technical Details
- Intezer's data: of 82,000 alerts that went through a live memory scan, about 2,600 machines had an active infection, and 51% of those were already marked mitigated by the EDR.
- The most common families found in memory were Mimikatz, Meterpreter and Cobalt Strike, tools built to live in memory where file-based "quarantined" status cannot see them.
- Nearly 1% of real incidents traced back to lowest-severity alerts (roughly 54 real threats a year at 450,000 alerts).
- 74% of identity alerts were classified as likely benign; impossible travel alerts were confirmed as compromise only about 2% of the time, and VPN usage drove around 30% of them.
- Jev is priced at $42 per billion input tokens, with responses in 70-500 ms. Cribl's model card admits the model can be overconfident and sensitive to prompt wording.
- The vendor's claimed results: over 25 million alerts investigated, under 2% escalated to humans, 98% verdict accuracy, median triage time under a minute (self-reported, not independently verified).
Remediation
- Collect evidence (process trees, detonation results, memory contents) before making a verdict.
- Do not let severity decide which alerts get investigated.
- Treat organizational knowledge (assets, users, normal behavior) as a continuously refreshed system.
- Measure calibration in your own environment by tying automated verdicts to outcomes and watching for drift.