All courses / AI Red Team / Module 5 / Chapter 18
Learning objectives
After the lesson the participant can:
- Assign a starting autonomy level to each step of the SOC workflow and name the main risk AI adds at that step.
- Review a triage record for grounding, a fixed verdict set and a statement of what was not established.
- Apply the five conditions under which an investigation agent may act without per-action approval.
- Design the introduction of a triage assistant at Level 1 Assisted, with baseline, shadow running and monitoring.
Key concepts
- Grounded triage record
- A structured result in which every claim cites its evidence, the verdict comes from a fixed set, and the service records what it could not establish. A line such as no EDR telemetry for this host is a DE.CM finding about a monitoring gap.
- Read, proposal and action tools
- Read tools query SIEM, EDR, inventory and intelligence, and their results are untrusted content. Proposal tools write hypotheses and proposed actions to the case. Action tools are listed in the manifest each with its own level, scope and reversal.
- Five conditions for bounded action
- The action is reversible with a tested reversal; the signal is high-confidence by a deterministic definition; the blast radius is bounded; a person is informed at once and holds a stop path outside the agent; and the forum that owns the risk grants the authority in a decision record.
- The agent does not watch itself
- An agent's telemetry goes to a store it cannot write to, detection engineering owns the detections watching it, and alerts go to the shift lead who holds its stop path. No AI component in the SOC triages alerts about itself.
- Approval latency
- An approval in under ten seconds for evidence that takes a minute to read is not oversight. The SOC reviews the latency distribution; the outcome may be an open move to Level 3 Bounded or a slower queue, never a Level 2 control that has silently become Level 3.
Interactive exercises
Do them here and get feedback at once. Choose a card and then where it belongs, or drag it.
Interactive exercise 1 · Sort
Read, proposal and action tools
Sort each tool in the permission manifest of HM-SEC-001 by its kind.
Interactive exercise 2 · Put in order
The SOC workflow
Put the six steps of the SOC workflow in order, from telemetry to recorded outcome.
Teaching plan
| 15 min | The teacher presents the yardstick metrics, the caution about attacker-controlled input and the workflow table with value, risk and starting level per step. |
| 15 min | Participants review the Nordvik triage record: which statement would they open first, and what does the not-established line tell them? |
| 20 min | Read the permission manifest of HM-SEC-001 and test each of its two Level 3 actions against the five conditions. |
| 30 min | Exercise: groups plan the introduction of a triage assistant at Level 1 Assisted and specify its grounded output and its monitoring. |
| 10 min | Debrief with the two chaos experiments: injected silence of a log source and a catalogued benign emulation on a test workstation. |
Discussion
- A component that saves analyst time but misses more true positives has made the SOC faster and worse. Which measures would reveal that in your SOC, and who would see them?
- Why does the chapter rule out the model's own confidence as a criterion for acting at Level 3 Bounded?
- When the customer and the MSSP both use AI, whose verdict should count when the tooling disagrees, and how should the disagreement be recorded?
Written exercise
Exercise · 30 minutes
Plan a triage assistant at Level 1 Assisted
For your SOC or Nordvik Region's, plan the introduction of an AI triage assistant following the practical guide. State mode, level, hosting, readable data and who may change the level. List the baseline measures and the baseline period. Specify the identity and tools. Define the output schema: fixed verdict set, statements each with evidence references, a not-established list, model and prompt version, and the analyst decision field without which nothing is escalated or closed. Set the shadow period, the share of alerts each analyst works unassisted, the detections on the assistant's own gateway logs and the monthly review against the baseline. Add the four questions your MSSP contract must answer if a provider shares the queue.
Deliverable: An introduction plan with decision-record content, baseline, identity and tools, output schema, shadow and unassisted shares, monitoring of the assistant and MSSP contract questions.
Self-test
Choose an answer to see whether it is right, or open the answer below each question.
What is the starting autonomy level the chapter gives for escalation in the SOC workflow?
Show the answer
C. Level 0 Advisory
The workflow table starts escalation at Level 0 Advisory: AI drafts incident summaries or suggests criteria, and the risk named is an alert reaching someone without authority to act.Which signal satisfies the chapter's condition of high confidence for action at Level 3 Bounded?
Show the answer
A. A reviewed detection corroborated by an independent source, or a honeytoken
The signal must be high-confidence by a deterministic definition, such as a reviewed detection corroborated by an independent source or a honeytoken; the model's own confidence is not a criterion.What does AI Act Article 26 require of deployers regarding the logs of high-risk AI systems, as the chapter reports it?
Show the answer
D. To keep the logs under their control for at least six months unless other law provides otherwise
The chapter cites Article 12 on automatic recording of events and Article 26 on deployers keeping the logs under their control for an appropriate period of at least six months, and draws the implication that these logs are also security telemetry.