ARIA's AI SOC sits above Wazuh's detection layer. Every alert is enriched before AI sees it, triaged with evidence citation requirements, verified by a second model, and routed to the right destination — with a full trace on every single alert.
The phrase "AI SOC" is often used to mean an AI product with a security use case. The more useful framing is narrower: an AI SOC automates the manual triage process — the part where a security analyst reads an alert, looks up the IP, checks whether the file hash is known-bad, pulls recent alerts for that user, and decides whether this is worth investigating further. That process is rule-following and evidence-gathering, which is exactly what AI can do reliably.
What an AI SOC does not replace is judgment on critical incidents: whether to isolate a production server, whether to revoke credentials during business hours, whether a pattern that looks like data exfiltration is actually a legitimate backup job. These decisions have operational consequences that require context only a human has. ARIA's AI SOC handles the triage pipeline; a security engineer handles the escalations.
This distinction matters for setting expectations. An AI SOC reduces the time between alert and disposition for routine events. It does not guarantee that every threat is caught. It makes a security engineer more effective by routing only the alerts that genuinely need human judgment.
ARIA uses Wazuh as its detection layer. Wazuh generates security events from endpoint agents, log analysis, vulnerability detection, file integrity monitoring, and cloud security modules. ARIA ingests those events and runs them through its triage pipeline.
Wazuh's strength is breadth: it covers the MITRE ATT&CK framework extensively, and its rule set maps most events to specific techniques and tactics. ARIA's pipeline preserves these mappings — the MITRE technique tag on each alert comes from the Wazuh sensor, not from AI inference, which matters for auditability. An AI-inferred MITRE tag is a guess; a sensor-sourced tag is evidence.
Wazuh's limitation in a small-business context is volume and noise. Default Wazuh rules generate many alerts per day in a typical environment, the large majority of which are not actionable. ARIA's triage pipeline is designed to address this: deterministic bypass rules close known-benign patterns before AI is invoked, and the AI triage stage filters the remainder to the subset that warrants human attention.
Before any alert reaches an LLM, a deterministic enrichment stage runs: threat intelligence lookups, alert history for the involved entity, and — for cloud events — identity context (MFA status, assigned roles, recent login events). The LLM receives a fully enriched alert package, not a raw Wazuh event.
The LLM produces a structured verdict with a specific constraint: each claim must cite the enrichment data that supports it. A verdict claiming "this IP has a poor reputation" must cite the threat intel lookup result. A verdict claiming "this user has no recent login history from this geography" must cite the identity context query result. The structure is enforced at the model output layer — a verdict that makes claims without citations does not pass validation.
The verdict then goes to a second model from a different vendor for independent verification. If the verifier agrees, the alert is routed based on the verdict: benign alerts are auto-closed with the full trace preserved; uncertain alerts are queued for a security engineer; high-confidence threat alerts escalate with the full evidence package. If the verifier disputes the verdict, the alert is held for a security engineer regardless of the triage conclusion.
Every alert that moves through ARIA's pipeline carries a complete trace: which enrichment sources were queried, what each returned, the triage verdict with its citations, the verifier's assessment, and the final routing decision. This trace is preserved whether the alert is auto-closed or escalated.
This matters for two reasons. First, for an alert that escalates to a human, the trace is the starting point for investigation — the engineer does not need to re-run the enrichment queries. Second, for auto-closed alerts, the trace is the evidence that the closure was justified. If a question arises later about why a particular alert was closed without escalation, the trace shows exactly what evidence the decision rested on.
What ARIA's AI SOC monitors:
Book a free assessment to see how the pipeline handles your actual alert environment.
Book Free Assessment