# Humans and Automation: Augmenting Security Operation Centers
## 3 Results and Findings
### SOC Automation Application Areas
#### 3.2.5 Automated Incident Response  
Various automated solutions were present in the incident response phase, demonstrating automation's technical advancements. Examples include decision support systems for known threats (rule-based systems) [35, 59] and decision support systems for unknown threats (adaptable intrusion response systems) [60, 61]. Concerning decision support systems, ref. [62] advocate for semi-autonomous systems that either offer recommendations and implementations depending on the threat faced. Several authors promote dynamic intrusion response initiatives--ones that are not solely based on predefined configured responses from security analysts but cater to variations of attacks [56, 60]. For instance, ref. [32] developed a dynamic intrusion response database that can be queried for the most recent countermeasures concerning a specific vulnerability. Ref. [26] differentiate between indirect automation integration and direct automation integration. The former assists in informing security analysts about threats and how to respond to them, and the latter will sense cyber threats and automatically respond to threats without human intervention. The decision to recommend and automatically implement a response is driven by the contex  
Figure 4: X-AI terminology. tual information collected [58]. This includes associated business processes and assets, instantiating the importance of context extraction and generation. Furthermore, the advent of AI and ML solutions in SOCs is clear [18, 28, 36, 63]. 10 SOAR platforms were reviewed in one study, and it was and revealed AI/ML's use cases across the incident response lifecycle phases [55]. For instance, IBM's Resilient QRadar SOAR integrates ML models trained using historical data to predict the severity of new incidents, estimate the time for resolution, and link similar recently resolved incidents. The rise of large language models has also extended into SOCs, e.g., Microsoft's Security Co-Pilot and CrowdStrike's Charlotte AI. Regarding Microsoft's tool, it is worth noting that in and of itself, the term \"co-pilot\" is synonymous with assisting or helping, showcasing the tool's effort to augment SOC analysts' capabilities. However, given that generative AI and ML tools require users (i.e., SOC analysts) to feed information into them, the confidentiality, integrity, and availability of an organization's security intelligence information (and to whom it is exposed) may hinder adoption rates. Ref. [18] evaluated security analysts' comfort levels with AI agents during the response phase and found that it was significantly lower when compared to the identification phase (M = 2.71 and M = 4.04, respectively, \(p\) < 0.001). More than half of the studies (29/49 or 59%) included in this analysis mentioned AI and ML solutions. Within the AI and ML domain, we found that 24.13% of articles focused on neural networks, 13.79% on visualization modules, and 10.3% on natural language processing (see Table 1). **Findings:** AI and ML solutions in the incident response phase must be accompanied by contextual information and data visualizations to aid analysts' understanding of how these systems arrive at solutions [58]. Furthermore, when these systems are utilized, it is imperative to know when they are better off as recommendation engines or implementation agents. Also relevant to the discussion of AI and ML models is whether they are subject to supervised or unsupervised learning, a topic that sparked much debate within the literature reviewed [36, 37, 38, 64]. We conclude that the critical nature of missed alerts demands highly trained supervised learning models to ensure greater accuracy in detecting threats. Nevertheless, due to the unpredictable nature of cybersecurity and its complexity, security analysts can gain advantages from using unsupervised models that detect abnormalities and patterns beyond traditional tool recognition. Hence, we suggest adopting a semi-supervised approach.