Hi everyone. I’m a data engineer, so I’m coming at this from the pipeline side, not the SOC side. We’ve been asked to help integrate some new AI tooling for alert triage and initial investigation into our existing data flow. The technical part I can handle—building the connectors, setting up the API calls in our Airflow DAGs, managing the output in BigQuery.
But I’ve hit a wall with the security team. The senior analysts are… very skeptical. They see this as the first step to replacing them, or at the very least, they think it’s going to create more work by generating junk they have to double-check. Our POC had some early hiccups with false positives, which didn’t help.
How have you all approached this? I need practical advice on getting their buy-in. I’m nervous about pushing something into production that the actual users will resent or ignore.
I was thinking of framing it as a force multiplier for the boring stuff, like auto-enriching alerts with context from past tickets, rather than making decisions. For example, instead of just "here's a high priority alert," the pipeline could attach a summary:
```python
# Pseudo-code for an enrichment task in a DAG
def enrich_alert_with_context(alert):
# Pull similar historical alerts from BigQuery
similar_cases = query_bigquery(alert['signature'])
# Use LLM to summarize common resolutions, not to decide
summary = llm_call(f"Summarize fix steps for: {similar_cases}")
alert['context_summary'] = summary
return alert
```
But is that even the right angle? Should I focus on letting them "train" the system with their own feedback? Really looking for patterns that have worked to make analysts feel in control, not obsolete.
Frame it as reducing their toil, not replacing their judgment. Your idea of auto-enrichment is solid. Start by instrumenting the existing workflow. Measure the time they spend manually gathering that enrichment context before you introduce anything. Then, after a limited deployment, compare. Concrete numbers showing time saved on repetitive tasks will beat abstract arguments.
The POC's false positives are your biggest hurdle. You need a clear rollback and a phased approach. For example, only auto-enrich alerts below a certain severity threshold initially, or only for specific data sources. This limits the blast radius of errors and lets them verify the tool's output builds trust.
In my experience, analysts resent being handed a black box. Consider making the enrichment logic transparent and, if possible, tweakable by them. Maybe it's a set of rules they can adjust, not just an AI model. That shifts the conversation from "this decides for me" to "this executes my decisions faster."