Notifications
Clear all
Topic starter
06/09/2026 9:34 am
TL;DR: Security alert correlation breaks down when LLMs ingest raw IOCs such as emails, URLs, IPs, domains, and hostnames, because token bloat and malformed structured output erode reliability, according to Legion AI. Replacing raw indicators with compact symbolic references turns multi-step investigations into a tractable agentic workflow, and that is the difference between experimentation and operational SOC automation.
NHIMG editorial — based on content published by Legion AI: How IOC Indexing Unlocks Automated AI Security Alert Correlation
By the numbers:
- Across 100 evaluation runs, Legion AI took JSON validity from about 80% to 100% and IOC reference compliance to 100%.
- A single newsletter email might contain 30+ URLs, each repeated across query results, reasoning, and indicator lists.
- In one case, an agent listed all 145 email addresses from its registry when the current query concerned a single sender.
Questions worth separating out
Q: How should security teams handle raw IOCs in LLM-driven investigations?
A: They should normalize raw IOCs into compact references before the model reasons over them.
Q: Why do long security investigations cause AI agents to lose output reliability?
A: As investigations expand, repeated indicators consume more context and encourage the model to echo everything it has seen rather than only what matters now.
Q: What do security teams get wrong about AI alert correlation automation?
A: They often assume prompt quality alone will solve the problem.
Practitioner guidance
- Implement IOC normalization before model ingestion Extract URLs, domains, IPs, emails, hostnames, and hashes into a registry before passing investigation text to the model, so the agent reasons over references instead of raw strings.
- Use stable reference mapping across the investigation lifecycle Assign one compact identifier to each indicator and preserve that mapping across every step, query result, and summary so repeated IOCs stay consistent.
- Clean malformed tool output upstream Convert comma-separated indicator strings into structured lists before they enter the prompt, because malformed tool output is a direct cause of invalid JSON and broken nesting.
What's in the full article
Legion AI's full article covers the operational detail this post intentionally leaves for the source:
- the exact IOC extraction and deduplication pipeline used to assign symbolic references
- the prompt adjustment rules and validation checklist for reference compliance
- the preprocessing logic used to clean malformed tool output before model ingestion
- the 100-run evaluation setup that measured JSON validity and IOC reference compliance
👉 Read Legion AI's analysis of IOC indexing for AI security alert correlation →
IOC indexing for security investigations: what changes for SOC teams?
Explore further
06/09/2026 9:34 am
IOC indexing is a memory-governance pattern, not just an LLM optimization. Security teams tend to focus on prompt quality, but this article shows that the deeper problem is how evidence is represented across an investigation. Symbolic references create a smaller, more auditable working memory for the agent. For SOC automation, the practical conclusion is that context governance is now part of detection engineering.
A question worth separating out:
Q: How can teams test whether AI investigation workflows are actually ready for production?
A: Measure them on multi-step traces, not isolated prompts. A production-ready workflow should preserve JSON validity, maintain correct indicator references, and avoid dumping irrelevant registry entries into the output. If any of those fail under realistic investigation length, the design still needs control work.
👉 Read our full editorial: IOC indexing makes AI security alert correlation reliable
