AI Agents Slash Security Alert Noise

Security teams often struggle to investigate every alert, leaving high-volume, low-severity notifications largely unexamined. Databricks has tackled this challenge by deploying a fleet of specialized AI agents for security alert triage, dramatically improving efficiency and threat detection.

These agents, each tuned to a specific alert source, run in real time on Spark Structured Streaming. This architecture enables automated triage of all low-severity alerts, achieving a true-positive rate 10 times higher than traditional high/medium escalations.

The Specialized Agent Approach

Initial attempts with a single, generalized foundation model proved ineffective, escalating 50% of alerts and creating new noise. The core issue was a lack of context: a single agent couldn't discern abnormal behavior across diverse security sources.

Databricks pivoted to 17 source-specific agents, each equipped with contextual knowledge, false-positive patterns, and behavioral baselines. A dedicated Threat Intelligence (TI) agent enriches alerts with actionable information, transforming raw indicators into immediate threats.

Architecture and Efficiency

The system leverages deterministic filtering to suppress known-benign signals, handling 30-95% of alert volume without LLM calls. For complex cases, agents enrich context with historical data and can invoke the TI agent or other tools to retrieve additional logs.

Each alert title maps to a specialized prompt function, guiding the LLM's reasoning. This focused approach, combined with shared utilities for invocation and performance evaluation, ensures accuracy and manageability.

Cost management is integral, with deterministic filtering, batch processing caps, and per-category tool call budgets preventing runaway expenses. When an agent escalates an alert, analysts review both the raw alert and the agent's analysis, providing feedback that continuously tunes performance.

Impact and Future

The system now reviews 100% of low-severity alerts, triaging over 18,000 alerts with a 3.2% escalation rate. This has saved over 6,500 analyst hours in just 30 days.

Key findings include a significant reduction in false positives from one source (72% to 3.4%) and the detection of suspicious domains and policy violations. Databricks emphasizes using LLMs for reasoning, not recall, and prioritizing predictable automation before agent intervention.