AI – Driven SIEM for cybersecurity incidence response and threat detection: A literature Review

Many alerts come to the Security Operations Centre out of which more than 95% are false positive alerts, and that is why there is an issue of alert fatigue and delayed responses. The conventional Security Information and Event Management (SIEM) systems operate on static rules; hence they cannot distinguish between the alerts. The present literature review is based on 23 recent publications accessed from IEEE Xplore and mainly focusing on the AI-Driven SIEM systems. The reviewed literature involves Wazuh-based Agentic AI with Model Context Protocol (MCP) integration, AI-based Behavior Analytics with Edge Processing using NVIDIA Jetson Orin, Generative AI and Reinforcement Learning framework, AI assisted Incident Investigations, and Explainable AI (XAI) for SOC. The primary results captured in the above literature include ML-enhanced wazuh that enables a decrease in false positives from 23% to 5%, Random forest and XGBoost reaching an accuracy of 96.9%, and agentic AI workflows decreasing MTTR from 804 minutes on the manual baseline to 15.2 minutes in a fully automated process as seen in a controlled environment. The review highlights gaps such as overfitting, token limitations on edge devices, no standardized XAI evaluation measures, and lack of real-world SOC validation. The future of threat detection will rely on the combination of SIEM + Agentic AI + XAI with a human in the loop.