The Autonomous SOC Blueprint- On-Premise ML & AI

The speaker, a former SOC data scientist, opens with an incident scenario in which investigators reconstruct a breach long after it happened. Alerts from separate tools arrive siloed, brittle correlation rules miss the links between them, and SIEM retention often expires before the full story can be pieced together. He cites the Singapore Health attack, which took more than a year to reconstruct by hand.

The proposed approach is a three-stage pipeline. First, a classification model tags every event with MITRE ATT&CK techniques instead of relying on hand-written labeling rules. Second, clustering groups similar events, such as repeated network flows from one session, so they can be deduplicated. Third, a Markov-chain style method links the grouped events causally into attack flows. He says a demo over about 10 terabytes ran on a small laptop with negligible compute cost, and that large language models can be added later to write investigation reports.

The practical takeaway is to keep existing detections and searches, place the enrichment and grouping step between the forwarder and the indexer, and focus on reducing redundancy rather than sampling or filtering. The volume reductions he quotes, from 80 to 99 percent, are his own estimates and were not independently benchmarked in the talk. He points to the open-source Attack Flow Detector project as a starting point.