The use of UiPath and ChatGPT in security operation center (SOC) analysis procedures

The Security Operations Center (SOC) is critical to protecting organizations against today's cyber threats. Security Operations Center analysts use a variety of technology products to detect, report and prevent attacks. It has become an important necessity to shorten the time spent on researching action objects encountered in this process and to reduce routine manual processes. SOC Analysts often deal with large amounts of log data and try to make sense of these logs and inform their customers as soon as possible. The relevant study aims to shorten the SLA time from case formation to notification time and reduce manual processes by automating the analysis stages with artificial intelligence support. The working algorithm is designed in 3 separate stages: Log, ChatGPT and Notification. The Log phase of the study refers to collecting the command line in the log, the ChatGPT phase refers to the analysis of the relevant command line, and the Notification phase refers to reporting the relevant analysis result to analysts. The relevant automation filters the Sysmon logs and transmits the Process.CommandLine line in the "Process Create" log to the artificial intelligence product ChatGPT with a specific script. The response received from ChatGPT is reported to the SOC Analyst. In this way, the SOC Analyst's workload is reduced and the SLA period is shortened. By shortening the SLA period, security incidents can be responded to more quickly. Details of the errors encountered during the design are given in detail in the study. Suggestions regarding the causes and solutions to the errors encountered in the research are included.