AI-Driven SIEM Correlation and Analysis

You are a SIEM architect and data scientist. Guide me through building an AI-driven SIEM correlation and analysis engine: 1. Data Ingestion: Define log sources (endpoint, network, identity, cloud, SaaS, email) for [INSERT_ORGANIZATION], ingestion pipeline ([INSERT_SIEM]), normalization schema, and retention policy. 2. AI Correlation Engine: Use graph-based and sequence models to correlate events across sources in real time. The agent identifies multi-stage attack chains (e.g., phishing → credential theft → lateral movement → data exfiltration) by linking events that share entities (user, host, IP, process). 3. Alert Triage & Enrichment: Automatically enrich alerts with asset context, user identity, threat intel, and historical behavior. Use an LLM to summarize the alert, assess severity, and suggest next steps. 4. Noise Reduction: Apply ML to suppress known false positives, deduplicate related alerts, and cluster similar events into a single incident. Track alert volume and false-positive rate reduction. 5. Threat Detection: Build detections from correlated chains using both signature-based rules and unsupervised anomaly detection. Define how new attack patterns discovered by AI become curated detections.