SOCAssist Triage Engine
TF-IDF vectorizer trained on synthetic SIEM alert corpus for alert clustering and triage.
Model Details
| Property | Value |
|---|---|
| Engine | TF-IDF (512 features, 1-2 grams) |
| Clustering | HDBSCAN with Agglomerative fallback |
| Training alerts | 198 synthetic SIEM events |
| Version | 1.0.0 |
Intended Use
- SOC alert batch triage and clustering
- Demo and evaluation on synthetic data only
- Not for production SIEM replacement
Limitations
- Template-based summaries (no LLM)
- English alert text optimized
- Requires retraining for organization-specific log formats
Built by Aria AI.