alirezaaminzadeh/soc-analyst-baseline

SOC Analyst Baseline Models

Baseline models for the SOC-AgentBench benchmark, published by Aria AI Security Research Team.

Models

Component	Method	File
Log Retrieval	BM25 (Okapi)	bm25_retriever.joblib
ATT&CK Mapping	Rule-based keyword matcher	attack_mapper.joblib
Severity Classification	TF-IDF + Logistic Regression	severity_classifier.joblib

Usage

import joblib

severity_clf = joblib.load("severity_classifier.joblib")
mapper = joblib.load("attack_mapper.joblib")
retriever = joblib.load("bm25_retriever.joblib")

text = "Suspicious LSASS memory access on WS-104"
severity = severity_clf.predict([text])[0]
techniques = mapper.predict(text)
scores = retriever["bm25"].get_scores(text.lower().split())

Evaluation

See eval_results.json for benchmark metrics on the SOC-AgentBench test split.

Related

• Dataset: soc-agent-bench
• Fine-tuned: soc-analyst-tool-use
• Playground: soc-agent-playground

License

Apache 2.0