AI Applied to Incident Response SBSeg 2026 Short Course 1
SBSeg 2026 Short Course 1 3 guided practices, 70 minutes

Artificial Intelligence Applied to Incident Response

From standards to executable practice: how Large Language Models can support incident response teams without taking the analyst out of the process.

The chapter's thesis: AI does not replace incident response. It extends the capacity for triage, analysis, documentation and recommendation when it is integrated with established frameworks, trustworthy data, adequate anonymization and human validation.

See the three practices Read the chapter (PDF, in Portuguese) Tool catalog Repository and notebooks
How the three practices connect

The pipeline in three stages

  1. Ticket received by the CSIRT
  2. EC1

    Pseudonymization

    ANON-LFI, AnonShield

    NER + regex + HMAC-SHA256

  3. Human validation
  4. EC2

    Classification

    AutoClass-LFI, SecLINC

    taxonomy + prompting

  5. Human validation
  6. EC3

    Playbook

    AutoClass-LFI

    Markdown and Ansible

  7. Documented, auditable response

The three case studies are not independent exercises: they form a single pipeline, in which the output of one feeds the next. Human validation appears between the stages, and not only at the end, because a classification error produces a silently wrong playbook.

Why this subject matters

Six numbers from the chapter

Two indicators explain the pressure on the teams, two come from the experiments carried out in the chapter itself, over the real ticket base, and two are reminders of where the limits lie.

516,556 incident reports recorded by CERT.br in 2024, an average of 1,411 per day. CERT.br, 2025
4 million is the estimated global shortfall of security professionals. Triage grows faster than the capacity to train analysts. ISC2, 2023
89.7% accuracy over 174 real tickets with a single labeled example per category, against 68.4% with no example at all. Almost all of the gain comes from a single confusion resolved, between vulnerability exploitation and intrusion attempt. Case study 2 of the chapter
5,256 sensitive entity replacements across 182 tickets, roughly 29 per ticket, for only 531 distinct entities. Each one reappears ten times on average, and it is that repetition that deterministic pseudonymization turns into correlation. Case study 1 of the chapter
42% of the summaries produced by models working alone contained factual inaccuracies, and 35% omitted critical details. In collaborative use, the same models reduce the analyst's effort. Kramer et al., SOUPS 2025
18.5% is the disagreement rate between two human analysts labeling the same tickets. That is the practical ceiling of any classifier evaluated against a human label. Jesus Filho et al., ICMLA 2025
What sets it apart

Real data, anonymized, with an explicit policy

Most teaching material on AI in security works over synthetic examples. Synthetic examples are clean, free of ambiguity and free of noise, and for that very reason they hide exactly the difficulties that characterize the real task.

No raw data leaves its source

The real tickets were provided by partner CSIRTs and pseudonymized locally, without relying on any external service. The live demonstrations work over synthetic tickets.

A base with the real imbalance

There are 182 records, one per distinct incident, accumulated over roughly 18 months. A single category holds 64.8% of the base and four categories account for about 94%, which makes overall accuracy a misleading metric and forces measurement per category.

Notebooks you can hold in your head

Each practice reimplements the essence of the mechanism in a few dozen lines of Python, without a GPU and without API credentials, so that the behavior observed in the production tool becomes inspectable.

The human in the loop is measured, not assumed

The GT-LFI cycle feeds the corrections made by analysts back into the knowledge the system uses. Human validation is a source of correction signal, and not merely a bureaucratic safeguard.

Diverse audience, different entry points

Where to start, depending on your profile

The material is the same for everyone. What changes is the order in which it pays off most. Pick the track closest to your situation.

Undergraduate student

First contact with incident response.

  1. Understand the chain: read the pipeline diagram above, end to end.
  2. Start with Practice 1: anonymizing is, above all, a detection problem, and that becomes visible within minutes.
  3. Fix the vocabulary: go through the standards and taxonomies group in the catalog.
Go to Practice 1 Standards and taxonomies

Instructor

Wants to use the material in a course or workshop.

  1. Use the notebooks as they are: they are self-contained and run without a GPU and without credentials.
  2. Make use of the discussion questions: each practice brings the questions that drive the analysis in class.
  3. Adopt the synthetic tickets: published in the repository, they require no data use agreement.
Practice guide Repository

Researcher

Wants to replicate, compare or extend the results.

  1. Read the methodological caveats: accuracy figures are only comparable when you know which set they were measured on and under which taxonomy.
  2. Map the gaps: data, evaluation, actionable explainability, human and AI collaboration, and agent verifiability.
  3. Go to the sources: the recommended reading list gathers the SoKs and the central empirical studies.
Recommended reading How to cite

CSIRT or SOC professional

Wants to assess what can be taken into operations.

  1. Decide the data policy first: pseudonymization is not anonymization, and pseudonymized data remains personal data under Brazil's data protection law, the LGPD.
  2. Measure the cost of privacy: roughly 60% accuracy with local open models against more than 90% with commercial models.
  3. Build the environment in layers: visibility, then behavioral detection, and only then the cognitive layer.
Tools from the group SOAR and response
Before the session

Set up your environment

The notebooks were written under three deliberate constraints: they are self-contained, they run without a GPU and without API credentials, and they reimplement the essential mechanism of each tool in a few dozen lines.

The bare minimum

Python 3.10 or later, with Jupyter
Version 3.10 is the minimum required. The repository ships a requirements.txt and virtual environment instructions. A local Jupyter or Google Colab, whichever you prefer.
No GPU
The reference demonstration of AnonShield runs on an ordinary laptop with four vCPUs and 8 GB of RAM. The speedup of more than 535 times over the previous generation is architectural, measured on CPU-only execution.
Optional credential
Only Practice 2 in its online version calls an API, and it has an equivalent offline variant. The others run with a local or simulated provider.
Clone the repository
The five notebooks, the synthetic tickets, the reference prompts and five standard operating procedures are all in the short course repository.
github.com/sbseg26-mc1/minicurso

There is always a credential-free path

Each practice has a route that needs no network, no API key and no budget, so that no connectivity scenario leaves anyone stuck.

  1. Practice 1: plain Python. If the Transformers library is unavailable, a simplified lexical recognizer takes the place of the NER and the lesson about coverage remains observable.
  2. Practice 2: 02-classificacao.ipynb calls Gemini in real time and asks for a Google AI Studio key. 02-classificacao_offline.ipynb embeds the results of a complete run and reaches the same numbers, with no network.
  3. Practice 3: the provider is selected by a single variable, among a local model via Ollama, an OpenAI-compatible API and a deterministic simulated generator. The simulated one is rule-based and is not a language model: it exists so that the mechanics of the pipeline can be exercised without infrastructure.
Models and local execution

About the data used in the practices

For the operational security of the contributing CSIRTs and in compliance with the LGPD, the real ticket base is not made available. The live anonymization demonstrations use synthetic tickets, published in the repository. Aggregate results over the real base are presented in precomputed form, always accompanied by the code that produced them.