A SOC analyst is investigating a potential ransomware infection. The SIEM has correlated multiple low-severity alerts into a single incident ticket. An AI assistant surfaces contextually relevant threat intelligence about the specific ransomware family based on observed indicators. Which AI-assisted security capability does this represent?

Question

Accepted Answer

A. AI-enhanced incident response — using AI to surface contextually relevant threat intelligence and accelerate investigation during active incidents. AI-enhanced incident response uses AI to correlate alerts, surface relevant threat intelligence, and accelerate analyst decision-making during active investigations. The SecAI+ objectives include using AI-driven tools to identify anomalies, detect threats, and accelerate incident remediation. Vulnerability scanning is a pre-incident assessment activity. Predictive threat modeling is a proactive planning activity. Automated patching is a remediation step, not an investigation accelerator.

Related Questions

Discussion