Interpretable Next-Generation SIEM

Abstract

Traditional Security Information and Event Management (SIEM) systems are characterized by the overload of alerts, high levels of false-positives, low susceptibility to detecting advanced persistent threats (APTs), and slow incident response. Such limitations lower the efficiency of real-time security monitoring in the present-day infrastructures. This paper introduces a next-generation SIEM, which can be interpreted and is automated to detect threats, respond to them, and improve the overall security of the system using artificial intelligence. The suggested platform will generalize Wazuh-based log collection with machine-learning models, LightGBM and the Bi-LSTM model. The techniques used to achieve explainable AI include LIME and SHAP, which can be used to produce interpretable threat scores, allowing an analyst to know the reasoning behind any given alert. Threat intelligence feeds are included, and well-known attack signatures are identified rapidly, whereas the unknown threats are discussed with the help of the AI models. There is a scalable log indexing and real-time visualization supported by a modular backend architecture based on Elasticsearch. The experimental findings show better detection rates, less workload on the analysts and greater responsiveness to APTs. The system proves the significant shortcomings of the traditional SIEM platforms and delivers high detection as well as interpretability in the AI-based decisions. This Interpretable Next-generation SIEM is to revolutionize the security operations by solving the most important issues of the traditional version of the system: absence of interpretability, workload, and APTs. It provides not only precise detection but also creates trust in AI-driven decisions, thus allowing security teams to decide confidently in dynamically changing threat environments.