Copyright © 2026 Authors retain the copyright of this article. This article is an open access article distributed under the Creative Commons Attribution License which permits unrestricted use, distribution, and reproduction in any medium, provided the original work is properly cited.

@article{210694,
        author = {Darshan Nikrad and Yash Nimbalkar and Sainath Pawar and Atharva khatavkar},
        title = {Autonomous AI SecOps Log Analyzer: An Evidence-Grounded Agentic Framework for Security Incident Detection, Correlation and Threat Prioritization},
        journal = {International Journal of Innovative Research in Technology},
        year = {2026},
        volume = {13},
        number = {6},
        pages = {1921-1925},
        issn = {2349-6002},
        url = {https://ijirt.org/article?manuscript=210694},
        abstract = {Security Operations Centres (SOCs) receive far more alerts than analysts can investigate. Rule-based monitoring yields many false positives, machine-learning anomaly detectors often return scores without explanation, and Large Language Model (LLM) assistants can produce plausible but unsupported conclusions. This paper presents the Autonomous AI SecOps Log Analyzer, an evidence-grounded agentic framework that ingests network and application logs, detects suspicious activity with eight rule-based detectors and an Isolation Forest, correlates detections into incidents using graph connected components, prioritizes them into tiers P1–P4, and investigates each incident with a tool-restricted agent. The agent is limited to seven read-only tools and 20 tool calls, tests malicious and benign hypotheses, defends against prompt injection hidden in logs, and rejects any conclusion not linked to verifiable source events. The system runs fully offline, with optional cloud or local LLMs. A five-condition ablation study on a deterministic synthetic dataset of 910 events (810 effective records) shows that correlation reduces 28 detections to 15 incidents (46%) and that all findings are evidence-attributed (100% attribution, 0% unsupported claims). Detection quality is modest (F1 = 0.356, FPR = 34.2%) and the data are synthetic, so the results are preliminary. The system is a decision-support tool and takes no enforcement action.},
        keywords = {Security operations centre, log analysis, anomaly detection, event correlation, agentic AI, evidence-grounded investigation, threat prioritization, Isolation Forest.},
        month = {November},
        }