Notifications
Clear all
Topic starter
18/08/2026 2:17 pm
TL;DR: Raw, unnormalized security logs caused an agent to miss every verdict in nine triage runs, even when reasoning effort was increased, according to Axoflow. The result is a data problem, not a model problem, because AI SOC workflows cannot reliably decide before logs are normalized and enriched.
NHIMG editorial — based on content published by Axoflow: Raw Logs Get AI Triage Wrong. Every Time
By the numbers:
- The agent spent 14 to 32 turns parsing and correlating 82 log lines before it could reach a verdict.
- A tighter system prompt reduced token spend by roughly 69% in the raw-log runs.
Questions worth separating out
Q: What breaks when AI triage is built on raw security logs?
A: The system loses decision quality before reasoning even starts.
Q: Why do identity and cloud context matter in AI SOC triage?
A: Because an IAM key, a service account, and a suspicious IP only mean something when the surrounding environment tells you whether they are expected.
Q: How do organisations know if AI triage is actually working?
A: Measure whether the AI improves high-fidelity detection, shortens time to verified response, and preserves reviewer trust in its decisions.
Practitioner guidance
- Normalize logs before agentic triage Convert firewall, endpoint, and cloud telemetry into a shared schema before the AI sees it, then validate that identity and event fields survive the transformation intact.
- Enrich identity and asset context upstream Attach known-scanner reputation, service account context, and asset ownership data before verdicting so the agent is not guessing about whether activity is expected.
- Measure verdict quality, not completion rate Track correct triage rate, false positives, and correlation quality across raw and normalized inputs, because a completed run can still be a failed decision.
What's in the full article
Axoflow's full article covers the operational detail this post intentionally leaves for the source:
- The full methodology behind the nine-run verdict test, including how raw logs were formatted and correlated.
- The token-spend comparison between tighter prompts and fuller reasoning, including the cost delta in practice.
- The normalized-data variant of the same triage scenario, showing exactly where the answer changed.
- The step-by-step architecture difference between parser-heavy triage and structured event analysis.
👉 Read Axoflow's analysis of why raw logs make AI triage fail →
Raw log triage for AI SOCs: what breaks before verdict time?
Explore further
18/08/2026 3:10 pm
AI triage becomes unreliable when raw telemetry is treated as decision-ready evidence. The core issue is not that the model cannot reason, but that the environment forces it to perform parsing, field mapping, and correlation before it can even decide what happened. That creates a fragile control plane where completion can be mistaken for correctness. For AI SOC programmes, the operating assumption that raw logs are suitable input is the first thing to challenge.
A question worth separating out:
Q: Should organisations optimise token cost before fixing log quality?
A: No. Token cost matters only after the data is trustworthy enough to support a correct decision. If raw logs still need heavy parsing and context reconstruction, cheaper prompts simply make the wrong answer cheaper to produce. Fix normalization, enrichment, and correlation first.
👉 Read our full editorial: Raw logs make AI triage fail before reasoning even starts
