Leveraging AI Techniques for Automated Security Incident Response

This thesis wants to design and develop a solution capable of automating the majority of operations within Security Operation Center (SOC). The project aims to meet the specific needs of the companies by improving the efficiency and effectiveness of security activities through advanced automation. Automation tends to reduce the workload of SOC analysts, allowing them to focus on more strategic and complex activities while increasing their ability to respond and solve problems. In particular, the project addresses many concrete issues identified in the Oplium's SOC, including efficient incident management and the optimisation of resources. These improvements ensure a more accurate response to incidents, reducing dependency on manual processes and improving the overall quality of the service provided. Another goal of the thesis is to respond to a specific need related to the implementation of a defacement monitoring system. This system is designed to detect and report any unauthorised changes to the customer’s websites in real-time enabling immediate and targeted intervention to prevent reputational or operational damage. This proactive monitoring helps to raise the level of security, demonstrating the effectiveness of the solution even in specific and particularly critical scenarios.