Last quarter, our security operations team hit a breaking point.
We had fully deployed our cloud infrastructure, hooked up our SIEM, configured EDR agents across all nodes, and tuned our detection rules. On paper, our posture was rock solid. In reality? We had created a monster.
Every morning, our Tier-1 analysts were greeted by a wall of 5,000+ alerts. A single suspicious outbound request meant opening CloudWatch, querying Elasticsearch, pivoting to CrowdStrike, cross-referencing VirusTotal, and checking AWS IAM roles. By the time an analyst stitched together the context for one alert, ten more had queued up.
The Missing Link: Standardized AI Context Pipelines
We initially tried wrapping LLMs around our SIEM using custom Python scripts and direct API calls. It worked for basic log summarization, but it rapidly devolved into a maintenance nightmare:
Rate limits kept blowing up during traffic spikes.
Every tool API update broke our custom prompt-stuffing scripts.
The LLM lacked live state awareness—it couldn't safely run additional diagnostic queries when an alert was ambiguous.
That's when we refactored our architecture around the Model Context Protocol (MCP).
Instead of hardcoding custom integration code for every security endpoint, MCP allowed us to expose security tools as standardized context servers.
When an alert triggers, the LLM agent uses MCP to autonomously query the endpoint's running process tree, pull network sockets, and fetch user activity logs—all within seconds—before presenting a synthesized incident report to the engineer.
The Technical Trade-offs & Engineering Learnings
Token Window Management: You can't just dump raw PCAP files or full audit logs into an MCP context payload. We had to implement strict pre-filtering protocols at the MCP server level.
Access Control Boundaries: We constrained MCP tools to read-only diagnostic capabilities by default. Remediation actions (like isolating a host) require an explicit analyst ACK in Slack or Teams.
Drastic MTTR Reduction: Mean Time to Respond dropped from 45 minutes down to under 4 minutes for routine triage.
We wrote an extensive breakdown covering our framework and results over on our guide on breaking SOC productivity barriers with MCP. If you are looking at structuring your team's defense roadmap, this modern SOC/MDR operational architecture guide is a great reference, backed by the engineering team at IPSIP Vietnam.
Over to You
How is your engineering or SecOps team handling context-stitching across your security stack? Are you building custom internal tooling, leveraging open protocols like MCP, or relying strictly on vendor-native AI plugins?
Let's discuss in the comments below! 👇
Top comments (0)