AI-Driven SIEM for Intelligent Incident Management: Integrating SOC Operations, Incident Response, Digital Forensics, and the Cyber Kill Chain

Abstract

While Security Information and Event Management (SIEM) systems are integral to the work of today's Security Operations Center (SOC), traditional rule-based SIEM solutions face growing challenges from the scale, complexity, and speed of today's cyber threats. The study reviews the use of Artificial Intelligence (AI) and Machine Learning (ML) technologies in strengthening SOC operations, speeding up incident response, aiding with digital forensics and correlating detection and response activities with the sequential steps of the Cyber Kill Chain. The qualitative conceptual approach is based on a systematic literature review, which draws on the most recent research on AI-based threat detection, automated incident response, correlation of forensic evidence, and adversarial modeling frameworks such as the Lockheed Martin Cyber Kill Chain and MITRE ATT&CK. The results suggest that the intelligent SIEM architecture can be broken down into five interrelated components: intelligent alert correlation, automated triage and response orchestration, forensic traceability, kill-chain-aware threat mapping, and human-AI collaborative decision making. AI is not meant to replace SOC analysts, it's meant to enhance their abilities to detect, investigate, and remediate incidents by eliminating alert fatigue, decreasing the mean time to detect and mean time to respond, and maintaining forensically sound evidence chains. The study suggests an integrated framework that places AI-powered SIEM in the context of the complete incident lifecycle, and connects detection engineering, orchestration, and post-incident forensic investigation to the sequence of the Cyber Kill Chain. The framework helps with the on-going debate on autonomous and semi-autonomous security operations and has practical implications to be considered when designing SOCs, training analysts, and purchasing tools, as well as for future empirical research.