Aegis-Mind: An Automated SOC Alert-Triage and Threat-Intelligence Enrichment Architecture with Cryptographic Webhook Verification

Modern Security Operations Centers (SOCs) face severe alert fatigue caused by high volumes of repetitive internal network telemetry and unverified external indicators of compromise (IoCs). Manual triage of IP addresses, domains, and binary hashes across threat-intelligence feeds increases Mean Time to Respond (MTTR) and analyst cognitive load. This paper presents Aegis-Mind, an automated SOC alert-triage and threat-intelligence enrichment system built in Python and Flask. The architecture enforces cryptographic webhook authenticity via HMAC-SHA256 signature verification, performs deterministic pre-filtering of RFC 1918 private IPv4 address spaces to eliminate internal non-routable noise, and integrates the VirusTotal v3 API with a local caching mechanism to enrich suspicious IP addresses, domains, and SHA-256 file hashes without redundant network lookups or API rate-limit exhaustion. Finally, Aegis-Mind automatically maps enriched security events to MITRE ATT&CK tactics and techniques and dispatches structured, real-time incident notifications to Slack and Discord channels. Experimental evaluation demonstrates significant reductions in false-positive alert volume, external API query overhead, and tier-1 incident triage latency.