AI Applied to Incident Response SBSeg 2026 Short Course 1
Chapter 1

Artificial Intelligence Applied to Incident Response

Short course book of the 26th Brazilian Symposium on Cybersecurity, SBSeg 2026, published by the Brazilian Computer Society. The chapter itself is written in Portuguese, under the title "Inteligência Artificial aplicada à Resposta a Incidentes".

Read the chapter (PDF, 50 pages, in Portuguese)

Abstract

Incident response teams face a volume of notifications that has long outgrown what manual triage can absorb. This chapter examines how Artificial Intelligence, and Large Language Models in particular, can support incident response without displacing the human analyst.

We combine consolidated frameworks (NIST SP 800-61r3, NIST CSF 2.0, and the FIRST CSIRT Services Framework), a structured review of the recent literature organised by application category, and three hands-on case studies conducted over a base of real, previously pseudonymised incident tickets provided by partner CSIRTs: pseudonymisation of tickets, automated incident classification, and assisted playbook generation. Each case study pairs a demonstration of the proponents' tools with a small, self-contained and executable notebook, published in an open repository.

The chapter's central message is that AI does not replace the incident response process; it enlarges triage, analysis, documentation and recommendation capacity when it is integrated with consolidated frameworks, trustworthy data, adequate anonymisation and human validation.

Resumo

Equipes de Resposta a Incidentes convivem com um volume de notificações que há muito ultrapassou a capacidade de triagem manual. Este capítulo examina como a Inteligência Artificial, e em especial os Modelos de Linguagem de Grande Escala, pode apoiar a resposta a incidentes sem deslocar o analista humano.

Combinam-se frameworks consolidados (NIST SP 800-61 Rev. 3, NIST CSF 2.0 e FIRST CSIRT Services Framework), uma revisão da literatura recente organizada por categoria de aplicação e três estudos de caso conduzidos sobre uma base de tickets reais de incidentes, previamente pseudonimizados, cedidos por CSIRTs parceiros: pseudonimização de tickets, classificação automática de incidentes e geração assistida de playbooks. Cada estudo de caso combina a demonstração das ferramentas do grupo proponente com um notebook simples, auto-contido e executável, publicado em repositório aberto.

A mensagem central é que a IA não substitui o processo de resposta a incidentes, mas amplia a capacidade de triagem, análise, documentação e recomendação quando integrada a frameworks consolidados, dados confiáveis, anonimização adequada e validação humana.

Who wrote it

Authors

  • Rodrigo Sanches MianiUniversidade Federal de Uberlândia
  • Sebastião Alves de Jesus FilhoUniversidade Federal de Uberlândia
  • Diego KreutzUniversidade Federal do Pampa
  • Cristhian KapelinskiUniversidade Federal do Pampa
  • Lourenço Alves Pereira JúniorInstituto Tecnológico de Aeronáutica
  • Sidnei BarbieriInstituto Tecnológico de Aeronáutica
  • Murray Evangelista de SouzaInstituto Tecnológico de Aeronáutica
How the chapter is organized

Eight sections, from normative foundation to executable practice

Section Title Role
1.1 Introduction Situates the pressure on the teams and what sets the short course apart: real anonymized data.
1.2 Basic Concepts and Frameworks Levels the vocabulary: the response life cycle, CSIRTs and SOCs, taxonomies, foundations of AI and of privacy.
1.3 State of the Art in AI for Incident Response A review organized by application category, deliberately including works that report limits.
1.4 Environments, Tools and Datasets Characterizes the resources the case studies work over, so that the reader can reproduce the material.
1.5 Case Study 1: Ticket anonymization The entry point of the pipeline. Protection coverage and preserved usefulness.
1.6 Case Study 2: Incident Classification Prompting strategies, commercial models against local models and the few-shot scenario.
1.7 Case Study 3: Playbook Generation From the classified incident to action, with emphasis on limits, risks and human validation.
1.8 Challenges, Trends and Conclusions Consolidates data, model and governance challenges, and addresses education and training.
What remains

The five conclusions

AI does not replace the incident response process

It extends the capacity for triage, analysis and recommendation. The empirical evidence supports that formulation precisely: models operating autonomously fail at rates incompatible with operational use, and the same models in collaborative use produce a consistent gain.

Methodology matters as much as the model

Combining a structured taxonomy with an iterative prompting heuristic improved classification consistency across every architecture evaluated. And a single labeled example per category can double the F1 of a classifier, a result the chapter reproduces over its own base: overall accuracy goes from 68.4% to 89.7% with one example per category and no additional API call per round. Both are low-cost, high-return interventions, available to any team.

Privacy is a design requirement, not a later stage

Pseudonymization is not a bureaucratic step that precedes the real work: it is the condition that makes it possible to operate over real data. The design decision that makes it viable without destroying usefulness is deterministic pseudonymization with preservation of the entity type.

Human validation is a source of signal, not just a safeguard

The design that sets mature proposals apart is the one in which the analyst's correction feeds back into the system. It is that feedback which turns the tool from a static product into an institutional asset that improves with use.

The real incident is a dual-purpose asset

Once treated with due care, the same material that feeds operations feeds education. Closing that cycle, from operations to the classroom and back, is probably the most lasting contribution the Brazilian security community can draw from this work.

To go further

Recommended reading

A selection from the chapter's references, favoring systematic reviews, studies with empirical evaluation over real data and works that report the limits of automation, and not only its gains.

  • 99% false positives: A qualitative study of SOC analysts' perspectives on security alarms Alahmadi, Axon and Martinovic. USENIX Security Symposium, 2022. The most cited empirical reference on alert fatigue. It distinguishes a false positive from a benign trigger and elicits the five properties an alert needs in order to be actionable.
    Paper
  • Integrating large language models into security incident response Kramer, Rosique, Narotam, Bursztein, Kelley, Thomas and Woodruff. SOUPS, 2025. The most rigorous study available, with 18 analysts and 50 real incidents. It shows that the decisive variable is not the capability of the model, but the mode of use.
  • SoK: Explainable machine learning for computer security applications Nadeem, Vos, Cao, Pajola, Dieck, Baumgartner and Verwer. IEEE EuroS&P, 2023. It concludes that explainability as practiced serves the researcher, and not the operator who has to decide whether to act.
  • SoK: AI support for analyst situation awareness in security operation centres Karunasingha, Baruwal Chhetri, Nepal, Paris and Kanhere. EuroUSEC, 2025. It identifies the human and AI collaboration gap: most proposals treat the analyst as a passive consumer of the model's output.
  • SoK: Applications and challenges of using recommender systems in cybersecurity incident handling and response Husák and Čermák. ARES, 2022. It frames the recommendation of response actions as a recommendation problem and identifies the central asymmetry of the domain: recommending an inadequate action in security can be worse than recommending nothing at all.
  • Incident Response Recommendations and Considerations for Cybersecurity Risk Management: A CSF 2.0 Community Profile Nelson, Rekhi, Souppaya and Scarfone. NIST Special Publication 800-61r3, 2025. The revision that repositions incident response as a facet of risk management.
    Publication
  • On-premise SLMs vs. commercial LLMs: Prompt engineering and incident classification in SOCs and CSIRTs Almeida, Pohlmann, Severo, Kreutz, Heinrich and Pereira Júnior, 2025. It quantifies the gap between open models run locally and commercial models, and what is gained in return.
    arXiv:2511.14908
  • Temperature in SLMs: Impact on incident categorization in on-premises environments Pohlmann, Severo, Almeida, Kreutz, Heinrich and Pereira Júnior, 2025. It isolates the variable that intuition suggests should matter and shows that it does not: the determining factors are the number of parameters and GPU capacity.
    arXiv:2511.19464
  • AnonLFI 2.0: Extensible architecture for PII pseudonymization in CSIRTs with OCR and technical recognizers Kapelinski, Lautert, Machado and Kreutz. WRSeg/ERRC, SBC, 2025. The generation that replaced the public hash with HMAC-SHA256 under a secret key.
    arXiv:2511.15744
  • Applying LLMs to the classification of cybersecurity incident tickets in a few-shot scenario Jesus Filho, Santana Santos, Dias Araújo and Sanches Miani. IEEE ICMLA, 2025. It shows that a single labeled example raises the mean F1 from roughly 46% to more than 90%, and documents the 18.5% disagreement between two human annotators.
  • Categorização de incidentes de segurança utilizando engenharia de prompts em LLMs Severo, Lautert, Kreutz, Bertholdo, Pohlmann and Quincozes. SBSeg, SBC, 2025. The most direct reference in the Brazilian context: it applies prompt engineering to four commercial LLMs over real reports from a CSIRT.
  • CACAO Security Playbooks Version 2.0 OASIS, 2023. The JSON playbook representation standard used as the interchange format in the third practice.
    Specification
Reference

How to cite

The chapter will be published in the SBSeg 2026 short course book, by the Brazilian Computer Society. The PDF available on this site is the authors' own version, preceding official publication. Fill in the page range and the digital identifier as soon as the publication becomes available. The reference below stays in Portuguese because it names the published title. 

@incollection{miani2026ia,
  author    = {Miani, Rodrigo Sanches and Jesus Filho, Sebasti{\~a}o Alves de
               and Kreutz, Diego and Kapelinski, Cristhian
               and Pereira J{\'u}nior, Louren{\c{c}}o Alves
               and Barbieri, Sidnei and Souza, Murray Evangelista de},
  title     = {Intelig{\^e}ncia Artificial aplicada {\`a} Resposta a Incidentes},
  booktitle = {Minicursos do XXVI Simp{\'o}sio Brasileiro de
               Ciberseguran{\c{c}}a (SBSeg)},
  publisher = {Sociedade Brasileira de Computa{\c{c}}{\~a}o (SBC)},
  year      = {2026},
  chapter   = {1},
  note      = {Material complementar em https://sbseg26-mc1.github.io/}
}
Funding and partnerships

Acknowledgments

The work behind this chapter received partial support from CAPES, funding code 001; from RNP, through the Hackers do Bem program and the GT-LFI (Learn From Incidents); from FAPERGS, through grant agreements 24/2551-0001368-7 and 24/2551-0000726-1; from CNPq, processes 409743/2025-9 and 408432/2024-1; and from ANATEL, through its Decentralized Execution Agreement with ITA.

The authors thank the partner CSIRTs and Points of Presence for providing the data that made the case studies possible.