Offline SOC alert triage study: PPO versus anomaly detectors

Evidence record

November 3 retrospective research evaluates different cluster-level operating points and shows failure to transfer ranking across tenants.

Read the original source ↗

Claim-level citations (3)

• supportsAI SOC triage methods cover different alerts, but transfer across tenants breaks: At a constrained 32-cluster selection point, the authors report benign escalation fractions PPO 0.000, autoencoder 0.007 and Isolation Forest 0.041; these are cluster-level results, not full-dataset false-positive rates.

  Results: cluster-level benign-escalation budget K=32 and 503 patterns

• supportsAI SOC triage methods cover different alerts, but transfer across tenants breaks: In the paper's separate cross-tenant experiment, the zero-shot ROC-AUC of Isolation Forest decreased from 0.7126 to 0.4681 and the autoencoder from 0.7682 to 0.4730; these were not reported as PPO transfer scores.

  Section 5.10 Multi-Tenant Replication, Table 11: AUC under zero-shot cross-tenant transfer

• supportsAI SOC triage methods cover different alerts, but transfer across tenants breaks: The reported PPO policy performed worse than random ranking when transferred without retraining to a second tenant with a different feature schema.

  Cross-tenant transfer experiment and limitations