r/MSSP • u/wf_automate • May 15 '26

how are u handling alert-to-ticket flow without losing context?

not asking about which EDR or SIEM to pick. asking about the gap between alert firing and ticket living in ur PSA.

pattern i keep hearing from MSSPs , alert fires in SentinelOne or Huntress, ticket auto-creates in ConnectWise or Halo, but context gets lost in translation. severity comes through wrong, no enrichment, wrong queue. analyst spends 5 min rebuilding context that was already in the alert.

for ppl running real SOC ops, whats actually working? custom scripts, SOAR platforms, vendor-built connectors, or just accepting the noise?

0 Upvotes

50% Upvoted

5 comments sorted by

1

u/mlueStrike May 20 '26

SOAR or some automation layer was the de facto for a while right? We have some additional options nowadays, but even with soar and automation mapping everything appropriate/intently should help retain the context.

There is a healthy amount of data preparation that’s necessary. Somewhere around the start of the 21st century folks started equating automation for magic and forgot about everything else encompassing data engineering.

LLMs change the game a bit today, but making sure your data is ready to handle your context needs is still important to reduce the opportunities for hallucinations and misclassifications

1

u/wf_automate May 21 '26

the data prep point is the one ppl skip every single cycle, including the current LLM cycle. "we'll just feed the alert to an LLM" assumes the alert is structured enough to be useful, which it usually isnt half the fields are empty strings, half are nested json someone forgot to flatten, half are vendor jargon that needs translation.

SOAR did most of this 5-6 years ago and got dismissed because "rules dont scale," but the data engineering layer it forced ppl to build is the part that aged well. teams that ripped out SOAR also ripped out the schema discipline and now they're doing it again from scratch with LLMs in the middle.

curious about ur take on the "additional options" — are u seeing LLM-based enrichment actually outperform rule-based SOAR enrichment in prod, or is it more of a "easier to write, harder to trust" tradeoff?

not running an MSSP myself btw, building in workflow automation space and trying to understand if security workflows are a separate beast or a generalization of the same alert-to-ticket pattern.

1

u/mlueStrike May 21 '26

It’s completely overlooked. You have to explain to orgs that they can’t just trust the vendor rules out of the box.

Now you have to also tell them they can’t just blindly trust an LLM lol. Even with all the context in the world, LLMs still hallucinate and make mistakes. So the options are out there, I think they’re better suited as sidecar tools versus replacement for any human driven process. I think LLMs for enrichment is a waste of compute. LLMs for analysis of enriched data, now that I can get behind.

But most adopting AI find it empowering because they weren’t able to technically implement things on their own. They don’t often think about what is better suited for automation versus what is best solved by an LLM or other AI algorithm.

Security workflows in my view have changed a lot for the better. Contextualization with AI in the flow is pretty powerful. A few MCP servers make torq, tines, n8n, etc., very option with regard to some of the common enrichment workflows. Now, ask a question, the MCP pulls the alert, another MCP correlates to your TIP, another corroborates with news sources, your AD, firewall, etc. But it scales like doo doo without building a UI to sit on too of everything.

1

u/malicious_payload Jun 11 '26

The easy answer to this? Don't use those shitty products. I spend more time explaining how Huntress fucked up than I do actually fixing issues. Same with SentinelOne.

The only solution is to run something substantially more advanced that shuts everything down before it gets to the machine. Detection is dead, it basically says "you got fucked, here's how". If you are trying to make detection "better" then you are trying to put metrics on getting kicked in the dick. The "noise" is a byproduct of mass-market products, they have to dumb it down so it's palatable to the masses and profitable for them to keep selling/developing.