Topic starter
11/11/2026 6:02 pm
TL;DR: More than 40% of security alerts go uninvestigated, according to Query, because analysts and AI tools still spend most of their time reconciling fragmented data across many consoles and inconsistent schemas. Normalization and access to complete context determine whether AI investigations produce reliable findings or confident mistakes.
Editorial analysis by NHI Mgmt Group, based on content published by Query: “Security Is a Data Problem. The AI Wave Just Made That Impossible to Ignore.”.
Key questions
Q: Why do fragmented logs make AI security tools less reliable?
A: AI systems depend on structured, correlated data.
Q: What is the difference between SIEM data and investigation data?
A: SIEM data is the raw or semi-processed security telemetry collected for detection and alerting, such as logs, events, and alerts.
Q: How do I normalize SOC data for AI investigation workflows?
A: Normalize SOC data by mapping alerts, logs, cases, and enrichment into a common schema with consistent timestamps, entity identifiers, event types, and severity fields.
Practitioner guidance
- Build a normalized security data model Define canonical entities for users, devices, IPs, sessions and alerts so investigations do not depend on ad hoc field mapping at query time.
- Reduce manual pivots across investigation tools Measure how many system switches, logins and lookups are required to resolve a single alert, then remove the highest-friction pivots first.
- Prioritise high-value identity and endpoint feeds Ensure the identity provider, endpoint platform and cloud logs that most often establish first access are available in the investigation layer without delay.
Bottom line: AI-assisted SOC performance depends on the quality and accessibility of the data layer, not just on the sophistication of the model.
Glossary terms: Schema Normalization, Security Information and Event Management (SIEM), Agentic Security Tooling, Identity Telemetry
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
11/11/2026 6:07 pm
Data normalization is now an investigation control, not an engineering preference. AI-assisted SOC work depends on a shared semantic layer for users, devices, IPs and event time. Without that layer, the system can produce fluent answers that are operationally unreliable, which makes normalization a governance issue as much as a technical one.
A question worth separating out:
Q: What happens when AI agents infer identity fields incorrectly?
A: Incorrectly inferred identity fields can cause an agent to act on the wrong person, service account, or device, which can misroute approvals, overextend access, or block the real owner from essential actions. Controls include strict schema validation, confidence thresholds, human review for ambiguous matches, and revocation of the agent’s delegated access when errors repeat.
👉 Read our full editorial: AI SOC success depends on data normalization, not model scale