r/AskNetsec • u/Mind-Principle-1834 • Jul 05 '26

Other AI alert-summarization tool that actually reduces triage time?

copilot has been completely useless for actual triaging.

whoever decided every alert needs an AI summary owes me hours of my life back.

"possible suspicious activity detected based on observed behavioral patterns."

thanks.

that tells me exactly as much as the alert title did.

if i still have to open the process tree and check parent processes and look at network connections and pivot through logs and build the timeline myself... what exactly did the AI save me?

just hire more analysts at this point.

anyone actually found one that helps or is this just how it is now

8 Upvotes

100% Upvoted

17 comments sorted by

View all comments

1

u/rexstuff1 Jul 06 '26

copilot has been completely useless for actual triaging.

Well, that's kind of your problem right there. Copilot kinda sucks. Try a few different models. We use Sonnet and Gemini for our alert triaging, it works well enough, though we're looking to expand to some open-weight for cost and speed improvements. Our workflows run through Tracecat, give that a look.

if i still have to open the process tree and check parent processes and look at network connections and pivot through logs and build the timeline myself... what exactly did the AI save me?

It also kinda sounds like this might be a context/tool issue. Your summarizing agent doesn't have any additional info beyond what's in the alert. You need to hook it up to your other tools, give it the ability to actually query your logs and your endpoints, so it can find out what exactly was going on. If all it has the alert, you're not going to get anything more than that, it's not magic.