Lesson 5 of 6
Lesson 5 — AI on the Defence: Inside a Modern SOC
Triage 10,000 alerts with a model, understand false positives, and learn why the human analyst never disappears.
Learn it
A Security Operations Centre (SOC) receives far more alerts than humans can read.
AI ranks and groups alerts so analysts start with the ones that matter.
Every model makes two kinds of mistake: crying wolf (false positive) and missing a real attack (false negative).
Key terms
- SOC
- Security Operations Centre — the team monitoring and responding to threats.
- False positive
- An alert on harmless activity.
- False negative
- A real attack the system failed to flag — the dangerous one.
- Precision
- Of the alerts raised, how many were real attacks.
- Recall
- Of the real attacks, how many were caught.
- Alert fatigue
- Analysts becoming desensitised by too many false alarms.
Reading a confusion matrix for a detection model
text Predicted attack Predicted benign
Real attack TP = 18 FN = 2
Real benign FP = 240 TN = 9740
precision = 18 / (18 + 240) = 0.070
recall = 18 / (18 + 2) = 0.90090% recall sounds excellent — but 93% of raised alerts are noise. That is how alert fatigue starts.
Sandbox lab
Practise the real technique in a fully simulated environment — no live systems, no real data, nothing leaves your browser.
SOC mini-lab: AI-assisted incident response
Simulated Security Operations Centre — fictional logs, fictional attacker, zero real systems.
- 1. Triage
- 2. Log review
- 3. Containment
- 4. Report
07:42 — the AI triage queue has surfaced six alerts with model risk scores. Select every true positive. Remember: a high model score is a signal, not a verdict.
Try it
Complete the recall calculation for the detection model above.
TP, FN, FP = 18, 2, 240
recall = ______
print(round(recall, 2)) # 0.9Challenge
Your school's detection model raises 300 alerts a day and one analyst can review 40. Propose how to use AI to make that workload survivable without missing real attacks.
Pick whichever way suits you — every mode earns the same bonus XP.
Write at least 40 more characters to submit.
Mark your own work
Guided walkthrough — 0/3 clues revealed
- Clue 1 locked — reveal it only if you get stuck.
- Clue 2 locked — reveal it only if you get stuck.
- Clue 3 locked — reveal it only if you get stuck.
Each clue costs 6 XP (never below 30 XP). You'd earn 60 XP right now.