Over the past few weeks i enrolled for AI in cybersecurity with Brixgate and have been privileged to run…
HOROIHEOMA C. — Cybersecurity Analyst
Over the past few weeks i enrolled for AI in cybersecurity with Brixgate and have been privileged to run hands-on experiments on AI for SOC in a controlled environment .It's getting interesting already!
Using AI models like(Ollama, MiniMax, and Claude) to handle real SOC workflows (alert triage, detection logic, even parts of incident response).
Plugging them into the day to day grind of a Security Operations Center.
The real enemy as a SOC analyst isn't sophistication but volume. Hundreds of alerts a day, most of them noise, a few of them real. Analysts burn out triaging the same false positives over and over, and the one alert that matters can get lost in the pile. So where do these tools actually fit in?
Ollama — running models locally means I can process sensitive logs and alert data without it ever leaving my environment.
MiniMax — surprisingly capable for fast, lightweight reasoning tasks: It's not going to write your incident report, but it's quick and cheap enough to run on everything.
Claude — this is where the deeper reasoning happened. Correlating alerts across different log sources, drafting a clear summary of what actually happened, suggesting next investigative steps. The kind of output a junior analyst would take twenty minutes to write, generated in seconds, and honestly readable enough to hand straight to a lead.
Contrary to many beliefs,Ai is not here to "replace the analyst." It s just compressing the boring 80% of the job (reading, correlating, summarizing ) so the human gets straight to the 20% that actually needs judgment.
Detection, triage, and even firstdraft response actions that used to take a full shift now happen in a fraction of the time.That said,these models still need, human review, and a lot of prompt tuning before you'd trust them on a real production SOC floor.
I also leaned about ai hallucination that posses a great risk ( AI hallucination is when a model generates output that sounds confident, but is factually wrong or entirely made up. The model isn't lying on purpose , it doesn't know it's wrong. It's just predicting the most statistically likely next words based on patterns it learned, and sometimes that pattern lands on something false rather than true)
My takeaway:
>The SOC of the near future probably isn't "AI replacing analysts." It's AI doing the first pass on everything, so analysts spend their energy where it actually matters .
>Instead of using weak prompts, it is best to use strong ,specific, structured prompts with roles, contexts and objectives to get desired and elaborate results.
Still early days for me on this though, but I'm convinced this is where security operations is heading. Curious if others are experimenting with this too .
#CyberSecurity #SOC #AI #ThreatDetection #Ollama #Claude #InfoSec #Brixgate
1 reactions · 0 comments
Topics: #ollama, #ai, #infosec, #claude, #cybersecurity, #soc, #brixgate, #threatdetection