Artificial intelligence can help SOC teams process large quantities of telemetry, but its output must be understandable before it can be trusted in operational security. For aSIEMmetry, explainability is therefore not an optional interface feature; it is a central requirement of the project.
An analyst reviewing an anomaly needs more than a score. The analyst must know which assets were involved, which behaviours changed, when the change occurred and what evidence supports the assessment.
Connecting conclusions to observations
The security entropy model is intended to identify significant deviations across monitored assets. Each result should be connected to the signals that contributed to it, such as unusual access patterns, changes in process activity or new relationships between systems.
This traceability allows analysts to verify whether the detected deviation is relevant. It also helps them identify data-quality problems or legitimate operational changes that the model has not yet learned.
Using the SOCagent to structure investigations
The specialized LLM SOCagent can support explainability by organizing technical evidence into a clear summary. It can identify the main entities, reconstruct a timeline and highlight questions that require analyst attention.
However, the LLM must not create unsupported conclusions. Its output should remain grounded in the events and model observations available to the system. Where evidence is incomplete, the assistant should communicate uncertainty rather than present a definitive result.
Supporting auditability and operational trust
SOC decisions may later be reviewed by incident-response teams, management, auditors or regulators. It is therefore important to preserve the evidence used during analysis and distinguish between machine-generated suggestions and analyst-approved conclusions.
The project’s self-hosted architecture can support this objective by keeping processing and outputs within a controlled environment. Access permissions and logging can be aligned with the organization’s existing security processes.
aSIEMmetry is developing AI as a support capability for trained analysts. By prioritizing explainability, the project aims to improve investigation speed without creating a black-box decision process. Trusted AI in the SOC depends on the ability to understand, verify and challenge every important recommendation.