SecLM SOC copilot: a retrieval-augmented large language model copilot for APT alert analysis in security operations centers

Abstract

Security operations center (SOC) analysts must interpret large volumes of alerts under severe time pressure, and this burden grows more demanding when advanced persistent threat (APT) activity is distributed across endpoint telemetry, network indicators, host context, and threat intelligence. This paper presents SecLM, a retrieval-grounded large language model (LLM) copilot, built on Google’s Gemini with a FAISS vector index over Sentence-Transformer (all-MiniLM-L6-v2) embeddings, that supports early-stage alert triage, investigation planning, and remediation recommendations for APT analysis. The proposed workflow embeds curated cyber security knowledge into a vector index, retrieves alert-relevant evidence, and conditions a generation module, guided by few-shot prompting and Pydantic-validated structured generation, on both the retrieved context and a predefined incident response schema. This design preserves the flexibility of natural language synthesis, while constraining the output to auditable fields that include an alert summary, a risk assessment, an investigation plan, remediation actions, and adversary behavior mappings aligned with MITRE ATT&CK. The system is evaluated through a DarkHydrus-inspired case study (ALERT-001) involving a high-severity malware alert on WORKSTATION-075, which communicates with a suspected command and control (C2) endpoint linked to DarkHydrus. The generated output correlates alert telemetry, host metadata, and threat intelligence into a six step investigation plan, a five-action remediation plan, and analyst-facing visual summaries. The study does not claim autonomous response or universal detection performance. Instead, it shows that retrieval-grounded LLM assistance can produce structured, reviewable, and machine-consumable response artifacts that reduce synthesis burden while preserving analyst control.