In a certain kingdom, at a certain SOC, they hired an AI analyst. The employee turned out to be diligent. While the on-duty analyst dozes off at the monitor, the agent patrols the servers and gathers alerts that set off alarms. Some are of low severity, but some are of greater severity. For each alert, he personally checks the logs, the EDR, the user directory, and the ticketing system, assembles the full picture, and reports whether it is an attack or rou