2_use_case_name: Elastic Machine Learning Threat Detection - Phase 2
3_agency: General Services Administration
3_abr: GSA
4_bureau: GSA
8_topic_area: Other
10_commercial_ai: None of the above.
11_purpose_benefits: Leverage an LLM that has been given access to our security logs, to provide a more efficient search and discovery tool for SOC analysts. The benefit would be helping the SOC analyst find records of interest and/or associated logs quicker. It will also analyze logs automatically and suggest records of interest.
12_outputs: Text displayed on the user's screen
16_dev_stage: Initiated
17_impact_type: Neither
18_date_initiated: Q4FY25
22_dev_method: Developed with contracting resources.
24_hisp_support: No
25_hisp_name: Public Experience Portfolio – GSA 
26_public_service: Enable increased self-service through an expansion of digital costumer service tools
27_public_info: No
29_contains_pii: No
30_saop_review: No
31_data_catalog: Yes
33_agency_data: System and application logs collected into our SIEM tool
34_data_docs: Documentation is complete: Documentation exists regarding the maintenance, composition, quality, and intended use of the training and evaluation data, as well as any statistical bias across model features and protected groups. 
37_custom_code: No
38_code_access: Yes – agency has access to source code, but it is not public.
40_has_ato: Yes
41_system_name: I-SecTools
42_dev_tools_wait: Less than 6 months
43_infra_provisioned: Yes
45_compute_request: No
47_timely_resources: Yes
49_existing_reuse: Use of existing data platforms: This use case is being developed on existing enterprise data and analytics platforms within the agency rather than procuring additional platforms or SaaS to operate.
50_internal_review: No documentation is available: No documentation detailing model performance metrics, model architecture, features and intended use of the models have been created or are currently accessible to other data science teams within the agency.
51_extension_request: No – Agency did not request an extension for this use case.
52_impact_assessment: No
53_real_world_testing: No testing: No testing of the model to simulate performance in an operational environment has been conducted thus far.
54_key_risks: No key risks identified. No PII or other demographic data fed into the AI system.
55_independent_eval: Planned or in-progress
56_monitor_postdeploy: No monitoring protocols have been established: Necessary infrastructure needed to perform monitoring of AI systems in production is not available and/or a plan to monitor models has not yet been established.
57_autonomous_impact: No - Some individual decisions or actions require direct human oversight.
59_ai_notice: In-person
61_adverse_impact: Yes
62_disparity_mitigation: No demographic data is collected by the SIEM tool. No demographic data fed to AI system for training or inference.
63_stakeholder_consult: None of the above
65_appeal_process: No – Law, operational limitations, or governmentwide guidance precludes an opportunity for an individual to appeal.
66_no_appeal_reason: The AI system is designed to provide data to a human SOC analyst when queried. The AI initiates no actions on its own nor is its output used directly.
67_opt_out: No – This AI use case is not subject to the opt-out requirement because the AI functionality is solely used for the prevention, detection, and investigation of fraud or cybersecurity incidents, or the conduct of a criminal investigation.
67_question_type: Human's review alerts generated and only human's make actionable decisions