From Investigation Failures to Reliable SOC Agents: Understanding and Improving LLM-Based Alert Triage
DGX agentarXiv:2610.10608v1 Announce Type: cross Abstract: Security operations centers (SOCs) must triage large volumes of alerts, most of which are benign, while missed attacks can remain uninvestigated. Tool