# AI Security for SOC Teams Checklist

Use this checklist before scaling SOC copilots, AI alert triage, SIEM query drafting, detection engineering, or AI-assisted incident response.

## 1. Evidence and Source of Record

- [ ] Keep SIEM, EDR, cloud logs, case records, and ticketing systems as the source of record.
- [ ] Require AI summaries to cite alerts, log lines, queries, detections, timelines, or tickets.
- [ ] Flag AI output as assistive analysis, not final incident truth.
- [ ] Store case IDs, analyst IDs, model names, tool calls, prompts, and final decisions.

## 2. Safe SOC Copilot Scope

- [ ] Allow read-only triage before write-capable response automation.
- [ ] Separate summarization from containment, account disablement, ticket closure, and firewall changes.
- [ ] Require human approval for production-impacting response actions.
- [ ] Keep high-risk actions reversible and logged.

## 3. Data Protection

- [ ] Remove secrets, customer data, regulated data, and privileged logs from unapproved prompts.
- [ ] Define which alerts, packet captures, emails, binaries, and case notes may be sent to each AI system.
- [ ] Use redaction or metadata-only summaries for sensitive investigations.
- [ ] Review retention settings for prompts, completions, and uploaded evidence.

## 4. Detection Engineering

- [ ] Use AI to draft SPL, KQL, Sigma, YARA, and timeline queries.
- [ ] Validate every generated query against known-good test data.
- [ ] Require detection owners to review logic, false positives, and data-source assumptions.
- [ ] Track whether AI-assisted detections improve precision, recall, or triage speed.

## 5. Incident Response

- [ ] Test AI workflows in tabletop exercises before real incidents.
- [ ] Include ransomware, identity compromise, cloud control-plane abuse, supply-chain compromise, and rogue automation scenarios.
- [ ] Define escalation paths when AI confidence is low or evidence conflicts.
- [ ] Preserve evidence before asking AI to summarize or transform it.

## 6. Metrics

- [ ] Measure mean time to triage, mean time to containment, false positives, reopened cases, and analyst review time.
- [ ] Track model cost and token usage by team, case type, and workflow.
- [ ] Review AI-assisted decisions in post-incident reviews.

Related HackWednesday pages:

- https://hackwednesday.com/ai-security-for-soc-teams
- https://hackwednesday.com/security-tool-skills
- https://hackwednesday.com/wednesday-brief
- https://hackwednesday.com/security-incident-map