Copyright © 2026 Authors retain the copyright of this article. This article is an open access article distributed under the Creative Commons Attribution License which permits unrestricted use, distribution, and reproduction in any medium, provided the original work is properly cited.

@article{192954,
        author = {Karu Praneeth Kumar and Aarupalli Karthik and Kanike Vinay and Pavadi Bharath and Dr G K V Narasimha Reddy and Dr C V Madhusudhan Reddy},
        title = {SOC Copilot: An AI-Powered Security Operations Assistant for Automated Threat Detection and Intelligent Incident Response},
        journal = {International Journal of Innovative Research in Technology},
        year = {2026},
        volume = {12},
        number = {9},
        pages = {2889-2896},
        issn = {2349-6002},
        url = {https://ijirt.org/article?manuscript=192954},
        abstract = {Heavy cyber attacks have pushed security teams into constant crisis mode. Day after day, they face endless warnings - each needing attention, each eating up time. Too many logs come in different shapes, too much noise clouds judgment, false alarms pile up fast. Analysts grow numb. That dullness slows everything down: spotting danger takes longer now, fixing it even more so. Old tools collect data but stick to rigid rules, unable to shift when hackers change tactics - they just add clutter instead. Enter SOC Copilot - a smart helper built with two types of algorithms working together. One spots odd behavior without knowing what’s coming; the other sorts real threats into categories using past examples. Together, they cut through confusion. It pulls records from various sources like JSON, CSV, Syslog, Windows EVTX files - not missing a beat. From those entries, it builds 78 unique traits based on patterns, timing, actions, connections. Then ranks urgency levels P0 to P4. Every result ties back to known attack methods via MITRE ATT&CK - and explains why clearly, plainly. Running without internet access, SOC Copilot puts governance at its core. Oversight stays with analysts every step of the way. Every move gets recorded - full traceability built in. Data never leaves local systems, meeting strict control standards. Testing shows it sorts threats correctly more than 99 times out of 100. Workload drops sharply because routine sorting happens automatically. Alerts arrive packed with context, cutting down decision time. Guidance comes clear, pointing straight to next steps. Speed improves across the entire reaction cycle, Cybersecurity automation improves threat detection with machine learning},
        keywords = {},
        month = {February},
        }