Condense Volumes, Connect Dots - Scaling Root Cause Analysis andTroubleshooting with ML

The talk opens with a familiar SOC problem: analysts face thousands of alerts from many tools, and retention and search budgets limit how much history can be correlated. Stitching a multi-month intrusion together across separate platforms is still largely manual. The speaker uses a 2017 healthcare breach as an example, showing how an attack spans a long timeline and many machines, which makes a single correlation search inadequate.

The proposed approach runs before the SIEM. A small, lightweight model tags each record with MITRE ATT&CK techniques and related control references, then clusters related records and orders them by causality into attack flows. The speaker points to highly redundant intrusion detection alerts that differ only in their timestamps, and argues that grouping and deduplicating such records can cut volume by roughly 90 percent without losing data.

The takeaway is partly financial and partly operational. Lower ingest and AI token costs can fund more analysts, and a smaller, enriched dataset gives downstream anomaly detection more useful signal. The project is presented as open source. The speaker notes that teams needing custom filtering rules should still use dedicated pipeline tools, while this approach focuses on the largest reduction gained from grouping.