CSOC AI Analyst Accelerator (Andesite AI)

Overview

Development stage

In development or acquisitionSource: a) Pre-deployment – The use case is in a development or acquisition status.

High-impact designation

High-impactSource: a) High-impact

Impact justification

Not reported

Start date

Not reported

Withheld from public reporting

Not reported

Mission

Topic area

Cybersecurity

Operational functions

Cyber threat detection Derived by keyword rules; see methodology

Problem the AI is intended to solve

VA Cybersecurity Operations Center (CSOC) requires new tools and capabilities to meet increasing demands for monitoring and securing the VA’s complex information technology (IT) environment, which currently involve time-consuming and manual processes.

Expected benefits

Andesite AI has the potential to be a significant part of VA’s overall defensive security strategy which will provide comprehensive visibility by enabling the cybersecurity team to transform and accelerate investigations, connect data silos, and decrease time to response. Hosted in VAEC AWS, Andesite AI will connect via API to several endpoints such as Splunk, SOAR, ThreatQ and the VA Network to seamlessly integrate information to assist Cybersecurity Analysts with their investigations.

System outputs

Andesite AI will submit prompts and retrieve results from AWS Bedrock (via Claude Sonnet) to help review potential incidents and perform investigations. The inputs of the model will include security event data from Splunk and Microsoft Sentinel used by CSOC analysts such as vulnerability data, indicators of compromise, security and event logs, and other threat intelligence data. Outputs of the model will include descriptions of potential incidents/vulnerabilities, suggestions on remediation and prioritization, and contextual information and correlation of various security event data. The users of Andesite AI will be 20 VA CSOC analysts.

Technology

AI classification

Generative AISource: Generative AI: AI that generates new or synthetic content (e.g., images, videos, audio, text, code).

System name(s)

Not reported

Custom-developed code

Not reported

Public source code

Not reported

Sourcing

How it was built

Not reported

Vendor (as reported)

Not reported

Vendors (standardized)

None on the standard list

A vendor is the supplier named by the agency. It does not identify the underlying model or AI technology.

Data and privacy

Involves PII

Not reported

Privacy Impact Assessment

Not reported

Authorization to Operate

Not reported

Demographic features

Not reported

Training and evaluation data

Not reported

Federal Data Catalog

Not reported

Governance

0 of 8 minimum-practice questions answered. A blank answer means the agency reported nothing; it does not mean the practice is absent.

Potential impacts and how they were identified

Not reported