Skip to content
Asinnah
العربية
All research

Mohamad Nour Shahin and Ruslan Damindarov

Published SVCC 2026

  • Incident response
  • SIEM
  • Agentic AI
  • Model Context Protocol
  • Security operations

Abstract

Security Operations Centers (SOCs) increasingly struggle with high alert volumes, limited analyst capacity, and strict mean-time-to-respond (MTTR) targets in industrial environments. This paper evaluates an AI-assisted incident-response workflow that integrates the Wazuh Security Information and Event Management (SIEM) platform with an AI assistant through a Model Context Protocol (MCP) server. In Phase 0, we establish a manual baseline: a human analyst triages alerts and writes incident reports for controlled attack scenarios deployed on Amazon Web Services (AWS) hosts protected by Wazuh agents, achieving 83.33% detection rate, 10.04 minutes average analysis time, 846 minutes dwell time, and 804 minutes MTTR. In Phase 1, the same scenarios are executed with AI assistance that uses MCP tools to query the Wazuh manager, enrich alerts, and generate structured incident reports, resulting in 91.67% detection rate (+8.34 percentage points), 1.23 minutes analysis time (−88%), 222 minutes MTTR (−72%), and 222 minutes dwell time (−74%) compared to Phase 0. In Phase 2, we extend the system with fully automated active-response capabilities, including IP blocking, account disabling, automated metrics tracking, and automatic reporting to the SOC engineer. Under this configuration, the system achieves 0.15 minutes average analysis time (98.5% faster than Phase 0), 15.2 minutes MTTR (98.1% faster than Phase 0), and 13.9 minutes dwell time (98.4% faster than Phase 0), with 87.50% precision and an 8.33% false-positive rate, both better than earlier phases. We measure key operational metrics, including mean time to detect (MTTD), analysis time, mean time to acknowledge (MTTA), mean time to respond (MTTR), detection quality, and attacker dwell time. The results confirm that MCP-based AI support can significantly improve analyst efficiency, response speed, and risk exposure, and that fully automated MCP-driven response further optimizes MTTR and dwell time, provided adequate SIEM rule coverage is in place.

In brief

  • Connects the open-source Wazuh SIEM to an AI assistant through a Model Context Protocol server, so the assistant can query alerts, search logs and, later, take scoped containment actions.
  • Runs the same 24 attack and false-positive scenarios three times: a human analyst alone, the analyst with AI help, and a fully automated response.
  • AI assistance cut analysis time from about 10 minutes to about 1 minute and time-to-respond by roughly 72%, while catching more incidents.
  • Full automation brought response time down to about 15 minutes with better precision and fewer false positives, as long as the SIEM's rules cover the attacks in play.

Cite this paper

@inproceedings{shahin2026agentic,
  author    = {Shahin, Mohamad Nour and Damindarov, Ruslan},
  title     = {Enhancing Cybersecurity Incident Response Efficiency Through Autonomous Agentic {AI}: Design, Implementation, and Evaluation with {Wazuh} {SIEM}},
  booktitle = {2026 Silicon Valley Cybersecurity Conference (SVCC)},
  pages     = {1--7},
  publisher = {IEEE},
  address   = {San Jose, CA, USA},
  year      = {2026},
  doi       = {10.1109/SVCC69905.2026.11642294}
}

More research