Adaptive Incident Prioritization for Security Operations at Scale

2026-07-18

AI Summary

This work addresses the challenge of prioritizing massive volumes of security events in large-scale Security Operations Centers (SOCs), where traditional time-based or coarse-grained severity-based ranking fails to accurately reflect true analyst priorities, thereby increasing cognitive load. The authors propose Adaptive Incident Prioritization (AIP), a novel algorithm that adapts BM25-style ranking to the query-free, multi-tenant SOC queue setting. AIP leverages normalized representations of security components and integrates saturated local frequency, cross-tenant global rarity, bounded domain-specific priors, and component-level interpretability to enable near real-time, low-latency re-ranking. The study introduces the first publicly available dataset with real-world incident priority labels and demonstrates 92.8% Precision@10 across evaluations involving over a thousand customers. Deployment results show significant improvements in analyst interaction efficiency compared to baseline methods, with a 5.8% increase in alert detail views and a 17.5% rise in incident reviews.

Abstract

Large security operations centers (SOCs) often face hundreds of active incidents per day, creating substantial cognitive and operational demands for analysts. Analysts must quickly decide which incidents deserve attention within long, constantly changing queues, yet incidents are commonly ordered by arrival time, coarse severity, or product-specific heuristics that leave their relative priority unclear. We introduce Adaptive Incident Prioritization (AIP), the ranking algorithm behind Microsoft Defender Queue Assistant, which continuously prioritizes security incidents for analyst investigation. AIP adapts BM25-style ranking to a query-less, multi-tenant queue setting by representing each incident as a collection of normalized security components extracted from alerts and metadata. The model combines saturated local component frequency, global component rarity estimated across tenants, bounded domain-prior multipliers, and component-level explanations. Deployed across tens of thousands of customers, AIP performs near-real-time inference and refreshes incident scores with a median latency of five seconds. In an expert-reviewed evaluation across 1,000 customer organizations, AIP achieves 92.8% Precision@10. In post-launch telemetry across 473,000 organization-day queues, AIP increases alert-detail interaction by 5.8% and alert-detail view events by 17.5% relative to severity ordering, providing behavioral evidence that model-ranked queues concentrate analyst engagement. We also extend the Microsoft GUIDE dataset with, to our knowledge, the first public label source for SOC queue prioritization over real-world incidents. The extension covers 499 organization queues and 9,980 incidents with expert-derived priority labels, enabling the research community to develop, compare, and advance methods for incident prioritization.

Problem

• incident prioritization
• security operations center
• queue ranking
• analyst workload
• security incident

Innovation

• Adaptive Incident Prioritization
• BM25-style ranking
• multi-tenant security queue
• real-time incident scoring
• SOC prioritization dataset