SOC analysts triage alarms correctly most of the time but rarely justify their decisions with the actual root cause.
ACM CSUR (2025)
1 Pith paper cite this work. Polarity classification is still indexing.
1
Pith paper citing it
fields
cs.CR 1years
2026 1verdicts
UNVERDICTED 1representative citing papers
citing papers explorer
-
Can SOC Operators Explain their Decisions while Triaging Alarms? A Real-World Study
SOC analysts triage alarms correctly most of the time but rarely justify their decisions with the actual root cause.