Generative AI-Based Intelligent Security Orchestration and Automated Cyber Incident Response: A Human-in-the-Loop Approach

Authors: Yanamadala Durga Prasad, Chetan Vasant Chaudhari

Published in: IJRRETAS, Volume 11, Issue 6, pp. 37-50 (05 Jun 2025)

Impact Factor: 7.95 (2025)

License: CC BY 4.0 CC BY 4.0 (Open Access)

Certificate: View Certificate

Abstract

The increasing dependence on digital infrastructure, cloud computing, online services and interconnected information systems has significantly expanded the exposure of organisations to cyber threats. Traditional cybersecurity mechanisms, including rule-based detection, signature-based monitoring and predefined incident response procedures, remain important but may struggle to handle complex, rapidly evolving and previously unseen attacks. Security Information and Event Management (SIEM) and Security Orchestration, Automation and Response (SOAR) platforms have improved security operations by centralising alerts and automating repetitive activities. However, incident investigation, contextual interpretation and high-impact response decisions continue to require substantial human involvement. Generative Artificial Intelligence (Generative AI), particularly Large Language Models (LLMs), offers new opportunities for improving cybersecurity operations through automated alert summarisation, contextual threat analysis, incident classification and response recommendation. Nevertheless, unrestricted AI-based automation introduces risks such as inaccurate outputs, hallucinations, prompt injection, unauthorised actions and inadequate accountability. This paper proposes a Generative AI-based intelligent security orchestration framework using a Human-in-the-Loop (HITL) approach. The proposed framework integrates security event collection, incident analysis, retrieval-augmented generation, response recommendation, human approval and policy-controlled execution.

Keywords
  • Generative AI
  • Cybersecurity
  • Security Orchestration
  • Automated Incident Response
  • Human-in-the-Loop
  • Large Language Models
  • SIEM
  • SOAR
  • Retrieval-Augmented Generation
  • Cyber Threat Intelligence
References
  1. Amershi, S., Weld, D., Vorvoreanu, M., Fourney, A., Nushi, B., Collisson, P., Suh, J., Iqbal, S., Bennett, P.N., Inkpen, K., et al. (2019) ‘Guidelines for human-AI interaction’, Proceedings of the 2019 CHI Conference on Human Factors in Computing Systems, Paper 3, pp. 1–13.
  2. Bender, E.M., Gebru, T., McMillan-Major, A. and Shmitchell, S. (2021) ‘On the dangers of stochastic parrots: Can language models be too big?’, Proceedings of the 2021 ACM Conference on Fairness, Accountability, and Transparency, pp. 610–623.
  3. Brown, T.B., Mann, B., Ryder, N., Subbiah, M., Kaplan, J., Dhariwal, P., Neelakantan, A., Shyam, P., Sastry, G., Askell, A., et al. (2020) ‘Language models are few-shot learners’, Advances in Neural Information Processing Systems, 33, pp. 1877–1901.
  4. Buczak, A.L. and Guven, E. (2016) ‘A survey of data mining and machine learning methods for cyber security intrusion detection’, IEEE Communications Surveys & Tutorials, 18(2), pp. 1153–1176.
  5. Cichonski, P., Millar, T., Grance, T. and Scarfone, K. (2012) Computer Security Incident Handling Guide. NIST Special Publication 800-61 Revision 2. Gaithersburg, MD: National Institute of Standards and Technology.
  6. Dwork, C. and Roth, A. (2014) ‘The algorithmic foundations of differential privacy’, Foundations and Trends in Theoretical Computer Science, 9(3–4), pp. 211–407.
  7. Gama, J., Žliobaitė, I., Bifet, A., Pechenizkiy, M. and Bouchachia, A. (2014) ‘A survey on concept drift adaptation’, ACM Computing Surveys, 46(4), Article 44.
  8. Greshake, K., Abdelnabi, S., Mishra, S., Endres, C., Holz, T. and Fritz, M. (2023) ‘Not what you’ve signed up for: Compromising real-world LLM-integrated applications with indirect prompt injection’, Proceedings of the 16th ACM Workshop on Artificial Intelligence and Security, pp. 79–90.
  9. Guo, C., Pleiss, G., Sun, Y. and Weinberger, K.Q. (2017) ‘On calibration of modern neural networks’, Proceedings of the 34th International Conference on Machine Learning, PMLR 70, pp. 1321–1330.
  10. He, H. and Garcia, E.A. (2009) ‘Learning from imbalanced data’, IEEE Transactions on Knowledge and Data Engineering, 21(9), pp. 1263–1284.
  11. Kent, K. and Souppaya, M. (2006) Guide to Computer Security Log Management. NIST Special Publication 800-92. Gaithersburg, MD: National Institute of Standards and Technology.
  12. Lewis, P., Perez, E., Piktus, A., Petroni, F., Karpukhin, V., Goyal, N., Küttler, H., Lewis, M., Yih, W., Rocktäschel, T., Riedel, S. and Kiela, D. (2020) ‘Retrieval-augmented generation for knowledge-intensive NLP tasks’, Advances in Neural Information Processing Systems, 33, pp. 9459–9474.
  13. McMahan, B., Moore, E., Ramage, D., Hampson, S. and Agüera y Arcas, B. (2017) ‘Communication-efficient learning of deep networks from decentralized data’, Proceedings of the 20th International Conference on Artificial Intelligence and Statistics, PMLR 54, pp. 1273–1282.
  14. National Institute of Standards and Technology (2020b) Zero Trust Architecture. NIST Special Publication 800-207. Gaithersburg, MD: NIST.
  15. National Institute of Standards and Technology (2023a) Artificial Intelligence Risk Management Framework (AI RMF 1.0). NIST AI 100-1. Gaithersburg, MD: NIST.
  16. National Institute of Standards and Technology (2023b) Adversarial Machine Learning: A Taxonomy and Terminology of Attacks and Mitigations. NIST AI 100-2 E2023. Gaithersburg, MD: NIST.
How to Cite
APA: Prasad, Y. D., & Chaudhari, C. V. (2025). Generative AI-Based Intelligent Security Orchestration and Automated Cyber Incident Response: A Human-in-the-Loop Approach. International Journal for Rapid Research in Engineering Technology & Applied Science, 11(6), 37–50. https://ijrretas.com/research-paper/generative-ai-based-intelligent-security-orchestration-and-automated-cyber-incident-respon-325