AI – Driven SIEM for cybersecurity incidence response and threat detection: A literature Review | IJCT Volume 13 – Issue 6 | IJCT-V13I6P80
IJCT
International Journal of Computer Techniques
ISSN 2394-2231 · Peer-Reviewed · Open Access
📚 Volume 13, Issue 6
📅 November 11, 2026
📄 Pages 685–689
🔖 ID: IJCT-V13I6P80
AI – Driven SIEM for cybersecurity incidence response and threat detection: A literature Review
Author(s)
Mr. Narayan Chandiram Dewani, Mrs. Bhagyashree Patil
Abstract
Many alerts come to the Security Operations Centre out of which more than 95% are false positive alerts, and that is why there is an issue of alert fatigue and delayed responses. The conventional Security Information and Event Management (SIEM) systems operate on static rules; hence they cannot distinguish between the alerts. The present literature review is based on 23 recent publications accessed from IEEE Xplore and mainly focusing on the AI-Driven SIEM systems. The reviewed literature involves Wazuh-based Agentic AI with Model Context Protocol (MCP) integration, AI-based Behavior Analytics with Edge Processing using NVIDIA Jetson Orin, Generative AI and Reinforcement Learning framework, AI assisted Incident Investigations, and Explainable AI (XAI) for SOC. The primary results captured in the above literature include ML-enhanced wazuh that enables a decrease in false positives from 23% to 5%, Random forest and XGBoost reaching an accuracy of 96.9%, and agentic AI workflows decreasing MTTR from 804 minutes on the manual baseline to 15.2 minutes in a fully automated process as seen in a controlled environment. The review highlights gaps such as overfitting, token limitations on edge devices, no standardized XAI evaluation measures, and lack of real-world SOC validation. The future of threat detection will rely on the combination of SIEM + Agentic AI + XAI with a human in the loop.
Keywords
SIEM, Wazuh, SOC, Agentic AI, Model Context Protocol, LLM, XGBoost, XAI, MITRE ATT&CK, Incident Response.
Conclusion
From this literature review, which is solely based on the 23 papers mentioned above, it is evident that there has been evolution from the rule-based SIEM systems (having high False Positive Rates) to behavior analysis at the edge to an agentic AI using MCP technology for triaging and response along with XAI technology for making everything transparent. The open-source system Wazuh along with the use of MCP server and local deployment of LLMs has consistently been highlighted as a more economical option to proprietary SOAR.[21] Future directions suggested by authors include RAG-Based memory, federated learning for privacy-preserving collobration, quntum-resistant alert verification.
References
[1] M. Shahin et al., "Enhancing Cybersecurity Incident Response Efficiency through Autonomous Agentic AI with Wazuh SIEM," IEEE Access, 2026.
[2] C. Peter et al., "AI-Based Behavior Analytics for Centralized SIEM with Edge Processing," EEE EU Conf., 2025.
[3] V. Gudur et al., "Leveraging GenAI and RL for Autonomous Cyber Threat Mitigation," ICAIC, 2026.
[4] M. Gorda, "On the Use of AI in Cybersecurity Incident Investigations," SmartIndustryCon, 2025.
[5] A. Pulivarthy, "Enhancing IT Service Desk with AI, SIEM and MFA," IEEE IT Pro., 2025.
[6] M. Ali et al., "The Rise of AI: Industry Insights and Applications in SIEM," IEEE BigDataSecurity, 2024.
[7] S. Valicek et al., "Application of Agentic AI for Incident Handling," IEEE SOAR, 2025.
[8] V. Chichurov et al., "The Adaptive AI SOC Agent," ICAIC, 2026.
[9] F. Binbeshr et al., "Rise of Cognitive SOCs: SLR on AI Approaches," IEEE ComST, 2025.
[10] R. Charla, "AI-Enhanced Automated Incident Response with Explainability," iSAI-NLP, 2025.
[11] A. Chauhan et al., "Conventional vs XAI-Driven Threat Analysis in SIEM," Int. J. Info. Security, Springer, 2025.
[12] S. Kumar et al., "Real-Time Log Analysis with Lightweight LLMs at Edge," IEEE EdgeCom, 2025.
[13] K. Zhang et al., "False Positive Reduction in SIEM using ML," IEEE BigDataSecurity, 2024.
[14] J. Smith et al., "LLM-Assisted Incident Response," IEEE S&P, 2025.
[15] L. Fernandez et al., "MCP Tools for Cyber Defense," IEEE AI4Cyber, 2025.
[16] H. Kim et al., "Dwell Time Reduction using AI Investigation," IEEE S&P Letters, 2025.
[17] R. Sharma, "XAI for SOC: SHAP with XGBoost," IEEE TAI, 2025.
[18] D. Brown et al., "Service Desk Integration with AI-SIEM," IEEE IT Professional, 2024.
[19] T. Chen et al., "Overcoming Token Limits in LLM Security Analysis," IEEE TDSC, 2025.
[20] J. Wilson, "Challenges in Deploying LLM Agents," IEEE Computer, 2025.
[21] K. Desai et al., "Comparative Analysis of Wazuh, Splunk, QRadar with AI," IEEE IEMCON, 2024.
[22] Y. Li et al., "RL for Adaptive Security Policies," IEEE TNNLS, 2025.
[23] P. Joshi et al., "Future of Autonomous SOC," IEEE Future Directions, 2026.
[24] Model Context Protocol, "Model Context Protocol Specification," Model Context Protocol, 2024. [Online]. Available:https://modelcontextprotocol.io/specification/2024-11-05
[25] Tariq, S., Baruwal Chhetri, M., Nepal, S., & Paris, C. (2025). Alert fatigue in security operations centres: Research challenges and opportunities. ACM Computing Surveys, 57(9), 1-38.
[2] C. Peter et al., "AI-Based Behavior Analytics for Centralized SIEM with Edge Processing," EEE EU Conf., 2025.
[3] V. Gudur et al., "Leveraging GenAI and RL for Autonomous Cyber Threat Mitigation," ICAIC, 2026.
[4] M. Gorda, "On the Use of AI in Cybersecurity Incident Investigations," SmartIndustryCon, 2025.
[5] A. Pulivarthy, "Enhancing IT Service Desk with AI, SIEM and MFA," IEEE IT Pro., 2025.
[6] M. Ali et al., "The Rise of AI: Industry Insights and Applications in SIEM," IEEE BigDataSecurity, 2024.
[7] S. Valicek et al., "Application of Agentic AI for Incident Handling," IEEE SOAR, 2025.
[8] V. Chichurov et al., "The Adaptive AI SOC Agent," ICAIC, 2026.
[9] F. Binbeshr et al., "Rise of Cognitive SOCs: SLR on AI Approaches," IEEE ComST, 2025.
[10] R. Charla, "AI-Enhanced Automated Incident Response with Explainability," iSAI-NLP, 2025.
[11] A. Chauhan et al., "Conventional vs XAI-Driven Threat Analysis in SIEM," Int. J. Info. Security, Springer, 2025.
[12] S. Kumar et al., "Real-Time Log Analysis with Lightweight LLMs at Edge," IEEE EdgeCom, 2025.
[13] K. Zhang et al., "False Positive Reduction in SIEM using ML," IEEE BigDataSecurity, 2024.
[14] J. Smith et al., "LLM-Assisted Incident Response," IEEE S&P, 2025.
[15] L. Fernandez et al., "MCP Tools for Cyber Defense," IEEE AI4Cyber, 2025.
[16] H. Kim et al., "Dwell Time Reduction using AI Investigation," IEEE S&P Letters, 2025.
[17] R. Sharma, "XAI for SOC: SHAP with XGBoost," IEEE TAI, 2025.
[18] D. Brown et al., "Service Desk Integration with AI-SIEM," IEEE IT Professional, 2024.
[19] T. Chen et al., "Overcoming Token Limits in LLM Security Analysis," IEEE TDSC, 2025.
[20] J. Wilson, "Challenges in Deploying LLM Agents," IEEE Computer, 2025.
[21] K. Desai et al., "Comparative Analysis of Wazuh, Splunk, QRadar with AI," IEEE IEMCON, 2024.
[22] Y. Li et al., "RL for Adaptive Security Policies," IEEE TNNLS, 2025.
[23] P. Joshi et al., "Future of Autonomous SOC," IEEE Future Directions, 2026.
[24] Model Context Protocol, "Model Context Protocol Specification," Model Context Protocol, 2024. [Online]. Available:https://modelcontextprotocol.io/specification/2024-11-05
[25] Tariq, S., Baruwal Chhetri, M., Nepal, S., & Paris, C. (2025). Alert fatigue in security operations centres: Research challenges and opportunities. ACM Computing Surveys, 57(9), 1-38.
📋 How to Cite This Paper
Mr. Narayan Chandiram Dewani, Mrs. Bhagyashree Patil (2026). AI – Driven SIEM for cybersecurity incidence response and threat detection: A literature Review. International Journal of Computer Techniques, 13(6), 685–689. ISSN: 2394-2231. DOI: https://doi.org/10.5281/zenodo.24130962
