International Journal of Network Security & Its Applications (IJNSA)
ISSN: 0974 - 9330 (Online); 0975 - 2307 (Print)
SOC using AI: Design and End-to-End Validation of an AI-Assisted Security Operations Center
Hashim Jarrar, Ahmad Aldarawish and Hatem Al-Kishawi, Middle East University, Jordan
Abstract
SOC using AI is an integrated Security Operations Center that combines deterministic detection with controlled AI assistance. Windows telemetry is collected through Sysmon and the Wazuh Agent, while Zeek and Suricata provide network visibility. Wazuh performs first-stage decoding and rule evaluation. A Python watcher selects newly generated security-relevant alerts, suppresses duplicate analysis, invokes local Ollama assistance, performs public-IP reputation checks through AbuseIPDB when appropriate, correlates related evidence, and stores incident data in SQLite for FastAPI and dashboard access. The wider platform also includes a CICIDS2017-oriented inference service with Random Forest, XGBoost, and Decision Tree artifacts; this ML service is a supporting component and is not presented as quantitatively benchmarked in this paper. Controlled host and network tests operationally verified the core event-toincident path, database integrity, agent connectivity, and service health. The reported results are limited to evidence observed in the final laboratory environment and do not constitute a statistical performance benchmark.
Keywords
Security Operations Center, Wazuh, Artificial Intelligence, Machine Learning, Incident Correlation
