# Breaking Alert Fatigue: AI-Assisted SIEM Framework for Effective Incident Response
## 1 Introduction  
Increased usage has exposed the Internet infrastructure and other network-connected systems to cyberthreats with increasing sophistication. In the past few years, the global cyber-security landscape has seen a steady number of reported incidents ranging from conventional attacks, e.g., ransomware, phishing, and denial of service (DoS) attacks, to novel, hybrid, and emerging threats that exhibit an upward trend and strong impacts [1; 2]. Thus, intrusion detection is a critical component to realize the operational and strategic goals of enterprise security operation centers (SOCs) to defend against these threats. Intrusion detection systems (IDS) can provide this capability by monitoring a network or systems and raising alerts when abnormal activities or policy violations are detected [3]. IDSs can be categorized into host-based IDSs (HIDSs) and network-based IDSs (NIDSs) [4]. HIDSs are installed on individual hosts or systems, and they are used to detect intrusions based on internal evidence, e.g., the modification or deletion of critical system files. In contrast, NIDSs are distributed at various network access points, and they detect intrusions by inspecting the communications between network-connected devices. Depending on the difference in their detection mechanisms, NIDSs lean toward proactive detection and prevention of intruding activities before a breach occurs, and HIDSs act as a second layer of defense, i.e., they operate at the endpoint level when a system is breached. In practice, NIDS and HIDS are frequently deployed to work in a collaborative and complementary mode to provide better security. Due to their comprehensive and proactive nature, enterprise SOCs often rely heavily on NIDSs to acquire a holistic perspective of the security situation and to prevent intrusionsat an early stage [5; 6]. Examples of widely adopted NIDSs include open-source projects, e.g., Snort [7], Zeek [8], and Suricata [9], and their commercial counterparts provided by security vendors, e.g., LastLine, which is now part of VMware [10], FireEye [11], and TrendMicro [12]. However, NIDS effectiveness is frequently hampered by the low quality of the issued alerts. As reported by [PERSON] et al. [13], when deployed in large financial institutions, Snort can produce more than 4,000,000 alerts per day on average. It is obviously unfeasible to process this many alerts manually in a common SOC, and the vast majority of low-quality alerts result in a considerable waste of valuable resources. Moreover, to maximize the detection rate for crucial incidents, many companies are now employing multiple IDSs in tandem with other security appliances. Nevertheless, this growing number of integrated security appliances generally worsens the security situation due to the so-called _alert fatigue_ issue, where security analysts become desensitized to the security alarms (alerts) after constant exposure to a large volume of promiscuous alerts with uncontrolled false positives. This desensitization can result in delayed incident responses and overlooked critical incidents, ultimately leading to increased network security risks and reduced service quality. A recent survey conducted by the Cloud Security Alliance [14] found that half of the enterprises surveyed utilize six or more security tools that generate alerts. Additionally, nearly one-third of IT security professionals who participated in the survey admitted to ignoring alerts due to the frequent occurrence of false positives. Alert fatigue is a serious barrier to implementing a consolidated security solution by integrating multiple security appliances. Currently, the common practice to mitigate the alert fatigue problem is to leverage a security information and event management (SIEM) system [15] to combine outputs from multiple sources for a consolidated security solution. Ideally, an SIEM should provide integrated functionalities, e.g., log data collection, efficient data retention, log indexing and searching, automated reporting, threat detection alerting, and event correlation.