Home / Current Issue / Paper 1724480
Smart Threat Response System Leveraging Standard Operating Procedures and Large Language Models
Subject area: Science,Engineering and Technology · Area of research: Artificial Intelligence and Cybersecurity
Abstract
When an alert reaches a SOC analyst, someone has to work out what kind of incident it is, find the Standard Operating Procedure (SOP) that covers it, judge how serious it is and decide what to do, usually while other alerts are waiting. Searching long SOP documents by hand is slow, and under pressure it is easy to pick the wrong procedure. We introduce the Smart Threat Response Assistant, a decision-support system that takes a normalized security alert, retrieves the matching passages from the organization’s SOPs using a vector database, and gives them together with the alert to a large language model (LLM). The model returns an incident summary, a severity estimate and step-by-step actions, each citing the SOP section it came from. Every recommendation is rated High, Medium or Low confidence, and Low ones go to an analyst before anything else happens. The system never acts on its own: an analyst approves, edits or rejects each recommendation, and the alert, the retrieved SOPs, the model output, the analyst’s decision and the time are written to an audit log protected with SHA-256 hashes. We describe the architecture and the eight-stage pipeline, compare the system with prior work on LLMs in the SOC, and set out a plan for evaluating it on simulated alerts. This paper presents a design demonstrated on simulated alerts; we do not report measured field results.
Keywords
audit logging; human-in-the-loop; large language models; retrieval-augmented generation; standard operating procedures
References
[1] Fieblinger R, Alam T, Rastogi N, et al. Actionable cyber threat intelligence using knowledge graphs and large language models. arXiv:2407.02528 [Preprint]. 2024.
[2] Fayyazi R, Taghdimi R, Yang SJ. Advancing TTP analysis: Harnessing the power of large language models with retrieval-augmented generation. arXiv:2401.00280 [Preprint]. 2024.
[3] Loumachi FY, Ghanem MC, Ferrag MA. GenDFIR: Advancing cyber incident timeline analysis through retrieval augmented generation and large language models. arXiv:2409.02572 [Preprint]. 2024.
[4] Cheng Y, Bajaber O, Tsegai SA, Song D, Gao P. CTINexus: Automatic cyber threat intelligence knowledge graph construction using LLMs. arXiv:2410.21060 [Preprint]. 2025.
[5] Singh R, Tariq S, Jalalvand F, Baruwal Chhetri M, Nepal S, Paris C, Lochner M. LLMs in the SOC: An empirical study of human-AI collaboration in security operations centres. arXiv:2508.18947 [Preprint]. 2025.
[6] Srinivas S, Kirk B, Zendejas J, Espino M, Boskovich M, Bari A, Dajani K, Alzahrani N. AI-augmented SOC: A survey of LLMs and agents for security automation. Journal of Cybersecurity and Privacy. 2025;5(4):95. https://doi.org/10.3390/jcp5040095
[7] Roy J, Singh SK. AgentSOC: A multi-layer agentic AI framework for security operations automation. arXiv:2604.20134 [Preprint]. 2026.
How to cite this paper
@article{1724480,
author = {Prof. Jyotibha R Chinchankar, Ananya Devadiga, Anujna, Nidhi V Poojari, Vamshi P Das},
title = {Smart Threat Response System Leveraging Standard Operating Procedures and Large Language Models},
journal = {Iconic Research And Engineering Journals},
year = {2026},
volume = {10},
number = {4},
pages = {4690-4697},
issn = {2456-8880},
url = {https://www.irejournals.com/formatedpaper/1724480.pdf},
abstract = {When an alert reaches a SOC analyst, someone has to work out what kind of incident it is, find the Standard Operating Procedure (SOP) that covers it, judge how serious it is and decide what to do, usually while other alerts are waiting. Searching long SOP documents by hand is slow, and under pressure it is easy to pick the wrong procedure. We introduce the Smart Threat Response Assistant, a decision-support system that takes a normalized security alert, retrieves the matching passages from the organization’s SOPs using a vector database, and gives them together with the alert to a large language model (LLM). The model returns an incident summary, a severity estimate and step-by-step actions, each citing the SOP section it came from. Every recommendation is rated High, Medium or Low confidence, and Low ones go to an analyst before anything else happens. The system never acts on its own: an analyst approves, edits or rejects each recommendation, and the alert, the retrieved SOPs, the model output, the analyst’s decision and the time are written to an audit log protected with SHA-256 hashes. We describe the architecture and the eight-stage pipeline, compare the system with prior work on LLMs in the SOC, and set out a plan for evaluating it on simulated alerts. This paper presents a design demonstrated on simulated alerts; we do not report measured field results.},
keywords = {audit logging; human-in-the-loop; large language models; retrieval-augmented generation; standard operating procedures},
month = {October},
}