The aSIEMmetry project is developing a specialized LLM SOCagent intended to support analysts during security monitoring and incident investigation. The component is designed for SOC use cases rather than general-purpose conversation, with attention given to security context, traceability and deployment control.
SOC analysts frequently work across multiple tools and data sources. They must review alerts, identify affected assets, reconstruct timelines and determine whether several apparently separate events are part of the same incident. This process can be time-consuming, especially when the environment produces large volumes of telemetry.
Turning security data into usable context
The SOCagent is intended to help organize available evidence and present it in a form that is easier to investigate. It may assist with summarizing activity, identifying relationships, explaining why an anomaly was raised and guiding analysts toward relevant follow-up questions.
Its role is complementary to the security entropy multi-agent model. While the entropy model identifies significant behavioural deviations, the LLM component can help translate technical observations into structured investigative context.
Why self-hosting is important
\n\n
Security logs can reveal sensitive details about users, internal systems, vulnerabilities and active incidents. For many organizations, sending this information to an external public AI service is not acceptable. aSIEMmetry therefore focuses on self-hosted models that can operate within controlled environments.
\n\n
This approach can support stronger data-governance requirements and allow organizations to determine where the model runs, which information it can access and how its outputs are stored. Self-hosting also makes it easier to align the component with local access controls and operational policies.
Maintaining analyst responsibility
The SOCagent is not intended to make unverified security decisions independently. Its conclusions must remain linked to observable evidence, and analysts must retain responsibility for validating findings and approving response actions.
Current project work focuses on the relationship between the LLM, the entropy model and existing SOC workflows. The objective is to create a practical assistant that reduces repetitive investigation work while improving consistency, transparency and analyst access to relevant security context.