{"data":{"id":"10.48550/arxiv.2609.32516","type":"dois","attributes":{"doi":"10.48550/arxiv.2609.32516","prefix":"10.48550","suffix":"arxiv.2609.32516","identifiers":[{"identifier":"2609.32516","identifierType":"arXiv"}],"alternateIdentifiers":[{"alternateIdentifierType":"arXiv","alternateIdentifier":"2609.32516"}],"creators":[{"name":"Chen, Huimin","nameType":"Personal","givenName":"Huimin","familyName":"Chen","affiliation":[],"nameIdentifiers":[]},{"name":"Long, Quan","nameType":"Personal","givenName":"Quan","familyName":"Long","affiliation":[],"nameIdentifiers":[]},{"name":"Wang, Yanhao","nameType":"Personal","givenName":"Yanhao","familyName":"Wang","affiliation":[],"nameIdentifiers":[]}],"titles":[{"title":"REFINE: A Resilient Evolution Framework for Intelligent Enterprise Alert Triage in Security Operations Centers"}],"publisher":"arXiv","container":{},"publicationYear":2026,"subjects":[{"lang":"en","subject":"Cryptography and Security (cs.CR)","subjectScheme":"arXiv"},{"lang":"en","subject":"Artificial Intelligence (cs.AI)","subjectScheme":"arXiv"},{"lang":"en","subject":"Machine Learning (cs.LG)","subjectScheme":"arXiv"},{"subject":"FOS: Computer and information sciences","subjectScheme":"Fields of Science and Technology (FOS)"}],"contributors":[],"dates":[{"date":"2026-09-26T12:01:32Z","dateType":"Submitted","dateInformation":"v1"},{"date":"2026-09-29T00:44:00Z","dateType":"Updated","dateInformation":"v1"},{"date":"2026-09","dateType":"Available","dateInformation":"v1"}],"language":null,"types":{"ris":"GEN","bibtex":"misc","citeproc":"article","schemaOrg":"CreativeWork","resourceType":"Article","resourceTypeGeneral":"Preprint"},"relatedIdentifiers":[],"relatedItems":[],"sizes":[],"formats":[],"version":"1","rightsList":[{"rights":"arXiv.org perpetual, non-exclusive license","rightsUri":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/"}],"descriptions":[{"description":"Security Operations Centers (SOCs) process large volumes of alerts daily. Alert triage prioritizes high-risk threats while reducing manual review of benign alerts. LLM agents can reason over logs and threat intelligence, but struggle to keep aligned with organization-specific, rapidly evolving SOC operational standards.\n We introduce REFINE, an LLM-agent framework for enterprise alert triage. REFINE encodes analyst expertise as structured skills and continuously adapts using analyst disposition feedback. It enforces recall = 1.0 as a hard constraint during evolution to maximize auto-closure of false positives, and identifies judgment blind spots by combining alert distributions with model error boundaries.\n Evaluated on four real industrial SOC scenarios across four MITRE ATT\u0026amp;CK phases with temporal split: REFINE achieves recall=1.0 on all evolution sets. On future test windows, it retains recall=1.0 in three scenarios; the degraded case reaches 0.807 recall, still outperforming self-evolution baselines (0.49-0.58).","descriptionType":"Abstract"}],"geoLocations":[],"fundingReferences":[],"xml":"PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz4KPHJlc291cmNlIHhtbG5zPSJodHRwOi8vZGF0YWNpdGUub3JnL3NjaGVtYS9rZXJuZWwtNCIgeG1sbnM6eHNpPSJodHRwOi8vd3d3LnczLm9yZy8yMDAxL1hNTFNjaGVtYS1pbnN0YW5jZSIgeHNpOnNjaGVtYUxvY2F0aW9uPSJodHRwOi8vZGF0YWNpdGUub3JnL3NjaGVtYS9rZXJuZWwtNCBodHRwOi8vc2NoZW1hLmRhdGFjaXRlLm9yZy9tZXRhL2tlcm5lbC00LjMvbWV0YWRhdGEueHNkIj4KICA8aWRlbnRpZmllciBpZGVudGlmaWVyVHlwZT0iRE9JIj4xMC40ODU1MC9BUlhJVi4yNjA5LjMyNTE2PC9pZGVudGlmaWVyPgogIDxhbHRlcm5hdGVJZGVudGlmaWVycz4KICAgIDxhbHRlcm5hdGVJZGVudGlmaWVyIGFsdGVybmF0ZUlkZW50aWZpZXJUeXBlPSJhclhpdiI+MjYwOS4zMjUxNjwvYWx0ZXJuYXRlSWRlbnRpZmllcj4KICA8L2FsdGVybmF0ZUlkZW50aWZpZXJzPgogIDxjcmVhdG9ycz4KICAgIDxjcmVhdG9yPgogICAgICA8Y3JlYXRvck5hbWUgbmFtZVR5cGU9IlBlcnNvbmFsIj5DaGVuLCBIdWltaW48L2NyZWF0b3JOYW1lPgogICAgICA8Z2l2ZW5OYW1lPkh1aW1pbjwvZ2l2ZW5OYW1lPgogICAgICA8ZmFtaWx5TmFtZT5DaGVuPC9mYW1pbHlOYW1lPgogICAgPC9jcmVhdG9yPgogICAgPGNyZWF0b3I+CiAgICAgIDxjcmVhdG9yTmFtZSBuYW1lVHlwZT0iUGVyc29uYWwiPkxvbmcsIFF1YW48L2NyZWF0b3JOYW1lPgogICAgICA8Z2l2ZW5OYW1lPlF1YW48L2dpdmVuTmFtZT4KICAgICAgPGZhbWlseU5hbWU+TG9uZzwvZmFtaWx5TmFtZT4KICAgIDwvY3JlYXRvcj4KICAgIDxjcmVhdG9yPgogICAgICA8Y3JlYXRvck5hbWUgbmFtZVR5cGU9IlBlcnNvbmFsIj5XYW5nLCBZYW5oYW88L2NyZWF0b3JOYW1lPgogICAgICA8Z2l2ZW5OYW1lPllhbmhhbzwvZ2l2ZW5OYW1lPgogICAgICA8ZmFtaWx5TmFtZT5XYW5nPC9mYW1pbHlOYW1lPgogICAgPC9jcmVhdG9yPgogIDwvY3JlYXRvcnM+CiAgPHRpdGxlcz4KICAgIDx0aXRsZT5SRUZJTkU6IEEgUmVzaWxpZW50IEV2b2x1dGlvbiBGcmFtZXdvcmsgZm9yIEludGVsbGlnZW50IEVudGVycHJpc2UgQWxlcnQgVHJpYWdlIGluIFNlY3VyaXR5IE9wZXJhdGlvbnMgQ2VudGVyczwvdGl0bGU+CiAgPC90aXRsZXM+CiAgPHB1Ymxpc2hlcj5hclhpdjwvcHVibGlzaGVyPgogIDxwdWJsaWNhdGlvblllYXI+MjAyNjwvcHVibGljYXRpb25ZZWFyPgogIDxzdWJqZWN0cz4KICAgIDxzdWJqZWN0IHhtbDpsYW5nPSJlbiIgc3ViamVjdFNjaGVtZT0iYXJYaXYiPkNyeXB0b2dyYXBoeSBhbmQgU2VjdXJpdHkgKGNzLkNSKTwvc3ViamVjdD4KICAgIDxzdWJqZWN0IHhtbDpsYW5nPSJlbiIgc3ViamVjdFNjaGVtZT0iYXJYaXYiPkFydGlmaWNpYWwgSW50ZWxsaWdlbmNlIChjcy5BSSk8L3N1YmplY3Q+CiAgICA8c3ViamVjdCB4bWw6bGFuZz0iZW4iIHN1YmplY3RTY2hlbWU9ImFyWGl2Ij5NYWNoaW5lIExlYXJuaW5nIChjcy5MRyk8L3N1YmplY3Q+CiAgICA8c3ViamVjdCBzdWJqZWN0U2NoZW1lPSJGaWVsZHMgb2YgU2NpZW5jZSBhbmQgVGVjaG5vbG9neSAoRk9TKSI+Rk9TOiBDb21wdXRlciBhbmQgaW5mb3JtYXRpb24gc2NpZW5jZXM8L3N1YmplY3Q+CiAgPC9zdWJqZWN0cz4KICA8ZGF0ZXM+CiAgICA8ZGF0ZSBkYXRlVHlwZT0iU3VibWl0dGVkIiBkYXRlSW5mb3JtYXRpb249InYxIj4yMDI2LTA5LTI2VDEyOjAxOjMyWjwvZGF0ZT4KICAgIDxkYXRlIGRhdGVUeXBlPSJVcGRhdGVkIiBkYXRlSW5mb3JtYXRpb249InYxIj4yMDI2LTA5LTI5VDAwOjQ0OjAwWjwvZGF0ZT4KICAgIDxkYXRlIGRhdGVUeXBlPSJBdmFpbGFibGUiIGRhdGVJbmZvcm1hdGlvbj0idjEiPjIwMjYtMDk8L2RhdGU+CiAgPC9kYXRlcz4KICA8cmVzb3VyY2VUeXBlIHJlc291cmNlVHlwZUdlbmVyYWw9IlByZXByaW50Ij5BcnRpY2xlPC9yZXNvdXJjZVR5cGU+CiAgPHZlcnNpb24+MTwvdmVyc2lvbj4KICA8cmlnaHRzTGlzdD4KICAgIDxyaWdodHMgcmlnaHRzVVJJPSJodHRwOi8vYXJ4aXYub3JnL2xpY2Vuc2VzL25vbmV4Y2x1c2l2ZS1kaXN0cmliLzEuMC8iPmFyWGl2Lm9yZyBwZXJwZXR1YWwsIG5vbi1leGNsdXNpdmUgbGljZW5zZTwvcmlnaHRzPgogIDwvcmlnaHRzTGlzdD4KICA8ZGVzY3JpcHRpb25zPgogICAgPGRlc2NyaXB0aW9uIGRlc2NyaXB0aW9uVHlwZT0iQWJzdHJhY3QiPlNlY3VyaXR5IE9wZXJhdGlvbnMgQ2VudGVycyAoU09DcykgcHJvY2VzcyBsYXJnZSB2b2x1bWVzIG9mIGFsZXJ0cyBkYWlseS4gQWxlcnQgdHJpYWdlIHByaW9yaXRpemVzIGhpZ2gtcmlzayB0aHJlYXRzIHdoaWxlIHJlZHVjaW5nIG1hbnVhbCByZXZpZXcgb2YgYmVuaWduIGFsZXJ0cy4gTExNIGFnZW50cyBjYW4gcmVhc29uIG92ZXIgbG9ncyBhbmQgdGhyZWF0IGludGVsbGlnZW5jZSwgYnV0IHN0cnVnZ2xlIHRvIGtlZXAgYWxpZ25lZCB3aXRoIG9yZ2FuaXphdGlvbi1zcGVjaWZpYywgcmFwaWRseSBldm9sdmluZyBTT0Mgb3BlcmF0aW9uYWwgc3RhbmRhcmRzLgogIFdlIGludHJvZHVjZSBSRUZJTkUsIGFuIExMTS1hZ2VudCBmcmFtZXdvcmsgZm9yIGVudGVycHJpc2UgYWxlcnQgdHJpYWdlLiBSRUZJTkUgZW5jb2RlcyBhbmFseXN0IGV4cGVydGlzZSBhcyBzdHJ1Y3R1cmVkIHNraWxscyBhbmQgY29udGludW91c2x5IGFkYXB0cyB1c2luZyBhbmFseXN0IGRpc3Bvc2l0aW9uIGZlZWRiYWNrLiBJdCBlbmZvcmNlcyByZWNhbGwgPSAxLjAgYXMgYSBoYXJkIGNvbnN0cmFpbnQgZHVyaW5nIGV2b2x1dGlvbiB0byBtYXhpbWl6ZSBhdXRvLWNsb3N1cmUgb2YgZmFsc2UgcG9zaXRpdmVzLCBhbmQgaWRlbnRpZmllcyBqdWRnbWVudCBibGluZCBzcG90cyBieSBjb21iaW5pbmcgYWxlcnQgZGlzdHJpYnV0aW9ucyB3aXRoIG1vZGVsIGVycm9yIGJvdW5kYXJpZXMuCiAgRXZhbHVhdGVkIG9uIGZvdXIgcmVhbCBpbmR1c3RyaWFsIFNPQyBzY2VuYXJpb3MgYWNyb3NzIGZvdXIgTUlUUkUgQVRUJmFtcDtDSyBwaGFzZXMgd2l0aCB0ZW1wb3JhbCBzcGxpdDogUkVGSU5FIGFjaGlldmVzIHJlY2FsbD0xLjAgb24gYWxsIGV2b2x1dGlvbiBzZXRzLiBPbiBmdXR1cmUgdGVzdCB3aW5kb3dzLCBpdCByZXRhaW5zIHJlY2FsbD0xLjAgaW4gdGhyZWUgc2NlbmFyaW9zOyB0aGUgZGVncmFkZWQgY2FzZSByZWFjaGVzIDAuODA3IHJlY2FsbCwgc3RpbGwgb3V0cGVyZm9ybWluZyBzZWxmLWV2b2x1dGlvbiBiYXNlbGluZXMgKDAuNDktMC41OCkuPC9kZXNjcmlwdGlvbj4KICA8L2Rlc2NyaXB0aW9ucz4KPC9yZXNvdXJjZT4=","url":"https://arxiv.org/abs/2609.32516","contentUrl":null,"metadataVersion":0,"schemaVersion":"http://datacite.org/schema/kernel-4","source":"mds","isActive":true,"state":"findable","reason":null,"viewCount":0,"viewsOverTime":[],"downloadCount":0,"downloadsOverTime":[],"referenceCount":0,"citationCount":0,"citationsOverTime":[],"partCount":0,"partOfCount":0,"versionCount":0,"versionOfCount":0,"created":"2026-09-29T05:33:42.000Z","registered":"2026-09-29T05:33:43.000Z","published":"2026","updated":"2026-09-29T05:33:43.000Z"},"relationships":{"client":{"data":{"id":"arxiv.content","type":"clients"}},"provider":{"data":{"id":"arxiv","type":"providers"}},"media":{"data":{"id":"10.48550/arxiv.2609.32516","type":"media"}},"references":{"data":[]},"citations":{"data":[]},"parts":{"data":[]},"partOf":{"data":[]},"versions":{"data":[]},"versionOf":{"data":[]}}}}