From Investigation Failures to Reliable SOC Agents: Understanding and Improving LLM-Based Alert Triage.

arXiv:2610.10608v1 Announce Type: cross Abstract: Security operations centers (SOCs) must triage large volumes of alerts, most of which are benign, while missed attacks can remain uninvestigated. Tool-using large language model (LLM) agents can retrieve eviden