Llm technology with human input reinforcement learning for suggesting the follow up response actions to detections and incidents

Abstract

A system and method are provided for providing guidance to SOC professionals regarding follow-up response actions to detection incidents. A machine-learning (ML) model is trained to receive incident data for security incidents/detections. The ML model then classifies the incidents/detections and determines thereby follow-on actions. Using the trained ML model to automatically generate follow-on actions enables the Security Operation Center (SOC) to timely triage and remediate a high volume of security incidents/detections. Reinforcement training data is generated based on user feedback generated when the SOC reviews the generated follow-on actions and then responds to the incident. The reinforcement training data is used to update and improve the ML model, allowing the ML model to adapt to evolving security threats and conform to current best practices.