AI Analysis
The AI layer turns structured alerts into clear investigation summaries. It uses Amazon Bedrock, with Claude 4 Sonnet in the current implementation, and Pinecone-backed retrieval to ground responses in telemetry, rule metadata, MITRE ATT&CK context, and similar historical events.
What the AI layer produces
- A plain-language explanation of the alert
- A likely classification such as malicious, suspicious, or benign
- A severity recommendation
- Relevant MITRE ATT&CK mappings
- Extracted indicators of compromise when supported by the evidence
- Suggested analyst next steps
AI analysis view
The analysis panel surfaces:
- A short summary of what happened
- The reasoning behind the classification
- Key indicators used by the model
- Risk level, confidence, and retrieval signal
- ATT&CK mappings, extracted IOCs, and follow-up action guidance
False-positive example
Showing both outcomes is useful because the AI layer is expected to:
- Escalate genuinely suspicious behavior
- Explain when an alert looks legitimate
- Reduce wasted triage time on noisy detections
Why RAG is included
Retrieval-Augmented Generation improves output quality by providing source context alongside the alert. In this project, Pinecone supports semantic retrieval for:
- MITRE ATT&CK technique context
- Semantically similar historical events
- Detection rule metadata
- Prior investigation notes or runbooks
- Security guidance and response procedures
This prevents the model from relying only on a single event record and helps it explain why the behavior matters in a familiar attack framework.
Example response shape
| Field | Purpose |
|---|---|
| Classification | Overall judgment for triage |
| Summary | Short analyst-facing narrative |
| Evidence | Key event signals that support the finding |
| ATT&CK mapping | Relevant techniques when supported |
| IOCs | File paths, hashes, domains, IP addresses, or commands worth tracking |
| Recommended actions | Next investigation or response steps |