Autonomous Alert Triage and Incident Response Pipeline Using Endpoint Telemetry, Wazuh SIEM, and Large Language Models

Modern Security Operations Centers (SOCs) face operational bottlenecks driven by high alert volumes, alert fatigue, and delayed triage across Tier-1 analyst queues. Traditional rule-based Security Information and Event Management (SIEM) systems produce substantial noise and require manual correlation against threat intelligence frameworks. In this paper, we design, implement, and evaluate an autonomous 5-layer SOC triage pipeline that integrates granular kernel-level endpoint telemetry via Windows System Monitor (Sysmon), Wazuh SIEM detection, custom orchestration middleware, and Large Language Model (LLM) inference for sub-second incident evaluation. The pipeline leverages custom XML detection rules mapped to the MITRE ATT&CK matrix, forwards alert payloads via asynchronous webhooks, and employs generative AI to provide structured threat verdicts, technique classification, and recommended containment steps. To mitigate alert flooding, a dynamic deduplication window and threshold filtering layer suppress non-critical telemetry, reducing noise before triage processing. We validate the system against simulated Living-off-the-Land Binaries and Scripts (LOLBAS) and credential-access attacks, measuring detection latency, classification accuracy, and false-positive suppression. Our findings demonstrate that integrating lightweight LLM reasoning with open-source SIEM infrastructure substantially reduces triage latency while maintaining high precision in technique mapping.