An Isolation Forest–Driven SOC Framework for Multi-Source Security Event Analysis and Human-Governed Automated Response

Modern organizations generate large volumes of security events from servers, endpoints, firewalls, intrusion detection systems, and security applications. Traditional security monitoring mainly depends on predefined rules and manual investigation, which can result in alert fatigue, delayed response, and difficulty identifying abnormal behavior across multiple security sources. This research proposes an AI-Based Intrusion Detection System and Automated Response platform using Machine Learning and Security Orchestration, Automation and Response (SOAR). The proposed system collects and analyzes security events through Wazuh and integrates Snort, UFW, honeypot, and Gophish components to create a practical Security Operations Center (SOC) environment. Machine Learning, particularly Isolation Forest-based anomaly detection, is used to analyze security-event features and identify suspicious behavior. The system also performs attack classification, severity assessment, event correlation, and controlled automated remediation. A web-based SOC dashboard provides real-time monitoring of threats, attacker IPs, ML scores, firewall actions, and pending analyst reviews. To reduce the risk of incorrect automated blocking, critical responses can follow a Human-in-the-Loop workflow where analyst approval is required before sensitive actions. The proposed system aims to reduce alert-analysis effort, improve detection capability, and provide faster and safer incident response.