All case studies / Case study 11 / 12
Ravelto Telecom
Security alert triage agent
An AI analyst that triages alerts so the security team can focus on real threats
In short
For each alert, the agent gathers the context (address reputation, user behaviour, firewall logs), classifies the threat with MITRE ATT&CK and drafts an incident report the analyst only has to approve.
- Client
- Ravelto Telecom
- Sector
- Telecommunications
- Size
- 3,000 staff, in-house SOC of 8 analysts
- 1,240 → 37alerts a day left for a human
- −75%investigation time per alert
- 100%of decisions approved by an analyst
The context
Ravelto Telecom’s security centre receives over a thousand alerts a day. Eight analysts cannot investigate them all: fatigue sets in, and a real attack can slip through among the false positives.
The challenge
- 01
Most alerts are false positives, but each takes 15 to 30 minutes to check.
- 02
Context is scattered across the SIEM, the directory, the firewall and reputation sources.
- 03
An AI must never block an account or a server without human approval.
- 04
Every decision must be logged and justifiable.
Our approach
A stateful agent (LangGraph) fires on every SIEM alert. It queries context sources through dedicated tools: IP reputation, login history in the directory, firewall logs in Elasticsearch. It maps the threat to a MITRE ATT&CK technique, rates its severity and drafts a report with a timeline and recommended actions. The analyst approves, edits or rejects; false positives are closed with their justification.
The solution, step by step
- 01
Thousands of alerts
1,240 alerts that day: most of them harmless, a few critical.
- 02
Context gathered
Address reputation, the user’s habits, firewall logs: in seconds.
- 03
Classified and rated
The threat is mapped to a MITRE ATT&CK technique and its severity estimated.
- 04
A report ready
Summary, timeline and recommended actions, written for the analyst.
- 05
The analyst decides
One click to approve the plan; nothing is blocked without human approval.
Results
- −97%alerts handled manually
- 4 minaverage investigation instead of 20
- 0blocking actions without approval
- 100%of alerts documented
What we deliver
- Stateful triage agent (LangGraph) connected to the SIEM
- Context tools: IP reputation, directory, firewall logs
- MITRE ATT&CK classification and severity score
- Incident reports and an approval queue for analysts
- SOC dashboard and audit log
Technologies
- LangGraph
- Python
- Elasticsearch
- MITRE ATT&CK
- Wazuh
- React
Timeline
8 to 12 weeks
Team
1 AI engineer, 1 security engineer
Illustrative cases: clients and figures are fictional, representative of the solutions we deliver.