Enhancing Cybersecurity Incident Response Efficiency Through Autonomous Agentic AI: Design, Implementation, and Evaluation with Wazuh SIEM

Security Operations Centers (SOCs) increasingly struggle with high alert volumes, limited analyst capacity, and strict mean-time-to-respond (MTTR) targets in industrial environments. This paper evaluates an AI-assisted incident-response workflow that integrates the Wazuh Security Information and Event Management (SIEM) platform with an AI assistant through a Model Context Protocol (MCP) server. In Phase 0, we establish a manual baseline: a human analyst triages alerts and writes incident reports for controlled attack scenarios deployed on Amazon Web Services (AWS) hosts protected by Wazuh agents, achieving 83.33% detection rate, 10.04 minutes average analysis time, 846 minutes dwell time, and 804 minutes MTTR. In Phase 1, the same scenarios are executed with AI assistance that uses MCP tools to query the Wazuh manager, enrich alerts, and generate structured incident reports, resulting in 91.67% detection rate (+8.34 percentage points), 1.23 minutes analysis time (−88%), 222 minutes MTTR (−72%), and 222 minutes dwell time (−74%) compared to Phase 0. In Phase 2, we extend the system with fully automated active-response capabilities, including IP blocking, account disabling, automated metrics tracking, and automatic reporting to the SOC engineer. Under this configuration, the system achieves 0.15 minutes average analysis time (98.5% faster than Phase 0), 15.2 minutes MTTR (98.1% faster than Phase 0), and 13.9 minutes dwell time (98.4% faster than Phase 0), with 87.50% precision and an 8.33% false-positive rate, both better than earlier phases. We measure key operational metrics, including mean time to detect (MTTD), analysis time, mean time to acknowledge (MTTA), mean time to respond (MTTR), detection quality, and attacker dwell time. The results confirm that MCP-based AI support can significantly improve analyst efficiency, response speed, and risk exposure, and that fully automated MCP-driven response further optimizes MTTR and dwell time, provided adequate SIEM rule coverage is in place.